243 lines
13 KiB
JSON
243 lines
13 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2022-49814",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2025-05-01T14:05:17.226Z",
|
|
"datePublished": "2025-05-01T14:09:38.389Z",
|
|
"dateUpdated": "2026-08-05T08:56:23.170Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-05T08:56:23.170Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nkcm: close race conditions on sk_receive_queue\n\nsk->sk_receive_queue is protected by skb queue lock, but for KCM\nsockets its RX path takes mux->rx_lock to protect more than just\nskb queue. However, kcm_recvmsg() still only grabs the skb queue\nlock, so race conditions still exist.\n\nWe can teach kcm_recvmsg() to grab mux->rx_lock too but this would\nintroduce a potential performance regression as struct kcm_mux can\nbe shared by multiple KCM sockets.\n\nSo we have to enforce skb queue lock in requeue_rx_msgs() and handle\nskb peek case carefully in kcm_wait_data(). Fortunately,\nskb_recv_datagram() already handles it nicely and is widely used by\nother sockets, we can just switch to skb_recv_datagram() after\ngetting rid of the unnecessary sock lock in kcm_recvmsg() and\nkcm_splice_read(). Side note: SOCK_DONE is not used by KCM sockets,\nso it is safe to get rid of this check too.\n\nI ran the original syzbot reproducer for 30 min without seeing any\nissue."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 7.8,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:L - The race is triggered only via local AF_KCM syscalls (socket, SIOCKCMATTACH/CLONE, setsockopt KCM_RECV_DISABLE/close, and recvmsg/recvmmsg); remote TCP data may fill the queue but cannot alone exercise the unlocked requeue versus recvmsg window.\nAC:L - The attacker controls both sides of the race—one thread in kcm_recvmsg while another drives requeue_rx_msgs via KCM_RECV_DISABLE, close/kcm_done, or mux RX paths on sockets they created—and can retry indefinitely; syzbot reproduced a GPF in skb_unlink with a C repro.\nPR:L - net/kcm/ has no capable()/CAP_NET_ADMIN checks; AF_KCM autoloads via MODULE_ALIAS_NETPROTO(PF_KCM), and an unprivileged user can create KCM sockets, attach their own TCP socket with a SOCKET_FILTER, and trigger the race (same PR:L posture as CVE-2025-38717).\nUI:N - The attacker performs socket setup, attach/clone, concurrent recvmsg and disable/close entirely themselves; no victim action is required.\nS:U - This is a standard in-kernel sk_buff heap use-after-free within the host kernel authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - The race leaves recvmsg holding a pointer to an sk_buff already dequeued/freed by requeue_rx_msgs, a reclaimable heap UAF that enables arbitrary kernel read via spray/reuse of the freed skb.\nI:H - Concurrent unlocked unlink/dequeue corrupts the receive-queue list and can double-free the skb, giving a heap write/control-flow primitive consistent with treating exploitable kernel UAFs as High integrity.\nA:H - Even without full exploitation, the bug causes a general protection fault/oops in skb_unlink from kcm_recvmsg (as demonstrated by syzbot), which is a full kernel availability impact."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"net/kcm/kcmsock.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "ab7ac4eb9832e32a09f4e8042705484d2fb0aad3",
|
|
"lessThan": "22f6b5d47396b4287662668ee3f5c1f766cb4259",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "ab7ac4eb9832e32a09f4e8042705484d2fb0aad3",
|
|
"lessThan": "d9ad4de92e184b19bcae4da10dac0275abf83931",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "ab7ac4eb9832e32a09f4e8042705484d2fb0aad3",
|
|
"lessThan": "ce57d6474ae999a3b2d442314087473a646a65c7",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "ab7ac4eb9832e32a09f4e8042705484d2fb0aad3",
|
|
"lessThan": "4154b6afa2bd639214ff259d912faad984f7413a",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "ab7ac4eb9832e32a09f4e8042705484d2fb0aad3",
|
|
"lessThan": "f7b0e95071bb4be4b811af3f0bfc3e200eedeaa3",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "ab7ac4eb9832e32a09f4e8042705484d2fb0aad3",
|
|
"lessThan": "bf92e54597d842da127c59833b365d6faeeaf020",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "ab7ac4eb9832e32a09f4e8042705484d2fb0aad3",
|
|
"lessThan": "5121197ecc5db58c07da95eb1ff82b98b121a221",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"net/kcm/kcmsock.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "4.6",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "4.6",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "4.14.300",
|
|
"lessThanOrEqual": "4.14.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "4.19.267",
|
|
"lessThanOrEqual": "4.19.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.4.225",
|
|
"lessThanOrEqual": "5.4.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.10.156",
|
|
"lessThanOrEqual": "5.10.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.15.80",
|
|
"lessThanOrEqual": "5.15.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.0.10",
|
|
"lessThanOrEqual": "6.0.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.6",
|
|
"versionEndExcluding": "4.14.300"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.6",
|
|
"versionEndExcluding": "4.19.267"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.6",
|
|
"versionEndExcluding": "5.4.225"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.6",
|
|
"versionEndExcluding": "5.10.156"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.6",
|
|
"versionEndExcluding": "5.15.80"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.6",
|
|
"versionEndExcluding": "6.0.10"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.6",
|
|
"versionEndExcluding": "6.1"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/22f6b5d47396b4287662668ee3f5c1f766cb4259"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/d9ad4de92e184b19bcae4da10dac0275abf83931"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/ce57d6474ae999a3b2d442314087473a646a65c7"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/4154b6afa2bd639214ff259d912faad984f7413a"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/f7b0e95071bb4be4b811af3f0bfc3e200eedeaa3"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/bf92e54597d842da127c59833b365d6faeeaf020"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/5121197ecc5db58c07da95eb1ff82b98b121a221"
|
|
}
|
|
],
|
|
"title": "kcm: close race conditions on sk_receive_queue",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |