232 lines
12 KiB
JSON
232 lines
12 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2022-49325",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2025-02-26T02:08:31.538Z",
|
|
"datePublished": "2025-02-26T02:10:48.158Z",
|
|
"dateUpdated": "2026-08-05T08:54:43.711Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-05T08:54:43.711Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: add accessors to read/set tp->snd_cwnd\n\nWe had various bugs over the years with code\nbreaking the assumption that tp->snd_cwnd is greater\nthan zero.\n\nLately, syzbot reported the WARN_ON_ONCE(!tp->prior_cwnd) added\nin commit 8b8a321ff72c (\"tcp: fix zero cwnd in tcp_cwnd_reduction\")\ncan trigger, and without a repro we would have to spend\nconsiderable time finding the bug.\n\nInstead of complaining too late, we want to catch where\nand when tp->snd_cwnd is set to an illegal value."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
|
"baseScore": 7.5,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:N - Zero snd_cwnd arises in TCP congestion/MTU-probe paths reached from tcp_rcv_established → tcp_ack → tcp_clean_rtx_queue while processing inbound ACKs, so a remote TCP peer triggers it via ordinary network packets.\nAC:L - A remote peer on a data-heavy connection can shrink cwnd (loss/ECN) and deliver the ACKs that enter cwnd-reduction or probe-success; those peer-side conditions are attacker-controlled, and MTU probing is enabled in realistic deployments.\nPR:N - Exploitation requires only exchanging TCP segments on an established connection to a listening service; no authentication or local privileges are needed.\nUI:N - No victim user action is required beyond an already-running TCP endpoint that sends data and processes peer ACKs.\nS:U - Impact stays within the host kernel TCP/congestion-control authority with no VM escape, IOMMU bypass, or other cross-boundary scope change.\nC:N - The defect only allows snd_cwnd to become zero and trip assertions/divides; it does not corrupt memory or disclose kernel or user data.\nI:N - There is no write primitive, type confusion, or control-flow hijack—only an illegal congestion-window value leading to WARN/div0/BUG paths.\nA:H - Zero snd_cwnd triggers WARN_ON_ONCE(!prior_cwnd), BUG_ON(cwnd <= in_flight), and divide-by-zero in congestion control, causing kernel oops/panic and full host DoS."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"include/net/tcp.h",
|
|
"include/trace/events/tcp.h",
|
|
"net/core/filter.c",
|
|
"net/ipv4/tcp.c",
|
|
"net/ipv4/tcp_bbr.c",
|
|
"net/ipv4/tcp_bic.c",
|
|
"net/ipv4/tcp_cdg.c",
|
|
"net/ipv4/tcp_cong.c",
|
|
"net/ipv4/tcp_cubic.c",
|
|
"net/ipv4/tcp_dctcp.c",
|
|
"net/ipv4/tcp_highspeed.c",
|
|
"net/ipv4/tcp_htcp.c",
|
|
"net/ipv4/tcp_hybla.c",
|
|
"net/ipv4/tcp_illinois.c",
|
|
"net/ipv4/tcp_input.c",
|
|
"net/ipv4/tcp_ipv4.c",
|
|
"net/ipv4/tcp_lp.c",
|
|
"net/ipv4/tcp_metrics.c",
|
|
"net/ipv4/tcp_nv.c",
|
|
"net/ipv4/tcp_output.c",
|
|
"net/ipv4/tcp_rate.c",
|
|
"net/ipv4/tcp_scalable.c",
|
|
"net/ipv4/tcp_vegas.c",
|
|
"net/ipv4/tcp_veno.c",
|
|
"net/ipv4/tcp_westwood.c",
|
|
"net/ipv4/tcp_yeah.c",
|
|
"net/ipv6/tcp_ipv6.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "5d424d5a674f782d0659a3b66d951f412901faee",
|
|
"lessThan": "3308676ec525901bf1656014003c443a60730a04",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "5d424d5a674f782d0659a3b66d951f412901faee",
|
|
"lessThan": "5aba0ad44fb4a7fb78c5076c313456de199a3c29",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "5d424d5a674f782d0659a3b66d951f412901faee",
|
|
"lessThan": "41e191fe72282e193a7744e2fc1786b23156c9e4",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "5d424d5a674f782d0659a3b66d951f412901faee",
|
|
"lessThan": "40570375356c874b1578e05c1dcc3ff7c1322dbe",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"include/net/tcp.h",
|
|
"include/trace/events/tcp.h",
|
|
"net/core/filter.c",
|
|
"net/ipv4/tcp.c",
|
|
"net/ipv4/tcp_bbr.c",
|
|
"net/ipv4/tcp_bic.c",
|
|
"net/ipv4/tcp_cdg.c",
|
|
"net/ipv4/tcp_cong.c",
|
|
"net/ipv4/tcp_cubic.c",
|
|
"net/ipv4/tcp_dctcp.c",
|
|
"net/ipv4/tcp_highspeed.c",
|
|
"net/ipv4/tcp_htcp.c",
|
|
"net/ipv4/tcp_hybla.c",
|
|
"net/ipv4/tcp_illinois.c",
|
|
"net/ipv4/tcp_input.c",
|
|
"net/ipv4/tcp_ipv4.c",
|
|
"net/ipv4/tcp_lp.c",
|
|
"net/ipv4/tcp_metrics.c",
|
|
"net/ipv4/tcp_nv.c",
|
|
"net/ipv4/tcp_output.c",
|
|
"net/ipv4/tcp_rate.c",
|
|
"net/ipv4/tcp_scalable.c",
|
|
"net/ipv4/tcp_vegas.c",
|
|
"net/ipv4/tcp_veno.c",
|
|
"net/ipv4/tcp_westwood.c",
|
|
"net/ipv4/tcp_yeah.c",
|
|
"net/ipv6/tcp_ipv6.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "2.6.17",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "2.6.17",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.15.47",
|
|
"lessThanOrEqual": "5.15.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.17.15",
|
|
"lessThanOrEqual": "5.17.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.18.4",
|
|
"lessThanOrEqual": "5.18.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.19",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.17",
|
|
"versionEndExcluding": "5.15.47"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.17",
|
|
"versionEndExcluding": "5.17.15"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.17",
|
|
"versionEndExcluding": "5.18.4"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.17",
|
|
"versionEndExcluding": "5.19"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/3308676ec525901bf1656014003c443a60730a04"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/5aba0ad44fb4a7fb78c5076c313456de199a3c29"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/41e191fe72282e193a7744e2fc1786b23156c9e4"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/40570375356c874b1578e05c1dcc3ff7c1322dbe"
|
|
}
|
|
],
|
|
"title": "tcp: add accessors to read/set tp->snd_cwnd",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |