Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2022-50838

net: stream: purge sk_error_queue in sk_stream_kill_queues()

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: net: stream: purge sk_error_queue in sk_stream_kill_queues() Changheon Lee reported TCP socket leaks, with a nice repro. It seems we leak TCP sockets with the following sequence: 1) SOF_TIMESTAMPING_TX_ACK is enabled on the socket. Each ACK will cook an skb put in error queue, from __skb_tstamp_tx(). __skb_tstamp_tx() is using skb_clone(), unless SOF_TIMESTAMPING_OPT_TSONLY was also requested. 2) If the application is also using MSG_ZEROCOPY, then we put in the error queue cloned skbs that had a struct ubuf_info attached to them. Whenever an struct ubuf_info is allocated, sock_zerocopy_alloc() does a sock_hold(). As long as the cloned skbs are still in sk_error_queue, socket refcount is kept elevated. 3) Application closes the socket, while error queue is not empty. Since tcp_close() no longer purges the socket error queue, we might end up with a TCP socket with at least one skb in error queue keeping the socket alive forever. This bug can be (ab)used to consume all kernel memory and freeze the host. We need to purge the error queue, with proper synchronization against concurrent writers.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 7737b104c211fa843de268b897d601e070292a72 to < c8c1eec578a9ae2dc8f14a1846942a0b7bf29d1daffected
  • 89be5c357de34718eaaaefed80737f432c5ab86f to < bab542cf56fc174c8447c00b73be99ffd66d2d39affected
  • 8b8b3d738e450d2c2ccdc75f0ab5a951746c2a96 to < 6f00bd0402a1e3d2d556afba57c045bd7931e4d3affected
  • b631c603b5fb98d2bd709c35d384901965a3dd51 to < 4f1d37ff4226eb99d6b69e9f4518e279e1a851bfaffected
  • daf15fa1fd997749e881aedd9f03f73a11240e82 to < 9062493811676ee0efe6c74d98f00ca38c4e17d4affected
  • 3988164fe9ddf98ebf5b5cdede91ac38c5f08a7e to < 9da204cd67c4fe97e8aa465d10d5c2e7076f7f42affected
  • 24bcbe1cc69fa52dc4f7b5b2456678ed464724d8 to < 8c330c36b3970d0917f48827fa6c7a9c75aa4602affected
  • 24bcbe1cc69fa52dc4f7b5b2456678ed464724d8 to < b458d349f8753f666233828ebd30df6f100cf7d5affected
  • 24bcbe1cc69fa52dc4f7b5b2456678ed464724d8 to < e0c8bccd40fc1c19e1d246c39bcf79e357e1ada3affected
  • 6ba975e14f5ebb87143d737c493adf4031409a68affected
  • 4437f3ead9e85c35fe0e3adfb98c0b97eaa267ebaffected
  • 4.9.291 to < 4.9.337affected
  • 4.14.256 to < 4.14.303affected
  • 4.19.218 to < 4.19.270affected
  • 5.4.160 to < 5.4.229affected
  • 5.10.80 to < 5.10.163affected
  • 5.15.3 to < 5.15.86affected
  • 4.4.293 to < 4.5affected
  • 5.14.19 to < 5.15affected

Linux Linux

Default version status: affected

  • 5.16affected
  • 0 to < 5.16unaffected
  • 4.9.337 to ≤ 4.9.*unaffected
  • 4.14.303 to ≤ 4.14.*unaffected
  • 4.19.270 to ≤ 4.19.*unaffected
  • 5.4.229 to ≤ 5.4.*unaffected
  • 5.10.163 to ≤ 5.10.*unaffected
  • 5.15.86 to ≤ 5.15.*unaffected
  • 6.0.16 to ≤ 6.0.*unaffected
  • 6.1.2 to ≤ 6.1.*unaffected
  • 6.2 to ≤ *unaffected

References