CVE-2022-49205

HIGH EPSS 17.3%
Published Feb 26, 20251y ago · Modified Jun 17, 20261w ago
7.8 CVSS 3.1
High
Find Similar
Published Feb 26, 2025 1y ago
Last Modified Jun 17, 2026 1w ago

Description

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix double uncharge the mem of sk_msg If tcp_bpf_sendmsg is running during a tear down operation, psock may be freed. tcp_bpf_sendmsg() tcp_bpf_send_verdict() sk_msg_return() tcp_bpf_sendmsg_redir() unlikely(!psock)) sk_msg_free() The mem of msg has been uncharged in tcp_bpf_send_verdict() by sk_msg_return(), and would be uncharged by sk_msg_free() again. When psock is null, we can simply returning an error code, this would then trigger the sk_msg_free_nocharge in the error path of __SK_REDIRECT and would have the side effect of throwing an error up to user space. This would be a slight change in behavior from user side but would look the same as an error if the redirect on the socket threw an error. This issue can cause the following info: WARNING: CPU: 0 PID: 2136 at net/ipv4/af_inet.c:155 inet_sock_destruct+0x13c/0x260 Call Trace: <TASK> __sk_destruct+0x24/0x1f0 sk_psock_destroy+0x19b/0x1c0 process_one_work+0x1b3/0x3c0 worker_thread+0x30/0x350 ? process_one_work+0x3c0/0x3c0 kthread+0xe6/0x110 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x22/0x30 </TASK>

CVSS Details

Base Score
7.8
Exploitability
1.8
Impact
5.9
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
17.3% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-415

Affected Products 5

VendorProductVersionRange
linuxlinux_kernel*≥4.20  –  <5.4.189
linuxlinux_kernel*≥5.5  –  <5.10.110
linuxlinux_kernel*≥5.11  –  <5.15.33
linuxlinux_kernel*≥5.16  –  <5.16.19
linuxlinux_kernel*≥5.17  –  <5.17.2

References 6

  • git.kernel.org https://git.kernel.org/stable/c/223f3c51ab163852dd4819d357dcf33039929434
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/2486ab434b2c2a14e9237296db00b1e1b7ae3273
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/94c6ac22abcdede72bfaa0f4c22fb370891f4002
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/ac3ecb7760c750c8e4fc09c719241d8e6e88028c
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/cb6f141ae705af0101e819065a79e6d029f6e393
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/cd84ea3920aef936c559b63099ef0013ce6b2325
    Patch

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/223f3c51ab163852dd4819d357dcf33039929434
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/2486ab434b2c2a14e9237296db00b1e1b7ae3273
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/94c6ac22abcdede72bfaa0f4c22fb370891f4002
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/ac3ecb7760c750c8e4fc09c719241d8e6e88028c
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/cb6f141ae705af0101e819065a79e6d029f6e393
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/cd84ea3920aef936c559b63099ef0013ce6b2325
    Patch