CVE - CVE-2022-49372

CVE-ID
CVE-2022-49372	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
In the Linux kernel, the following vulnerability has been resolved: tcp: tcp_rtx_synack() can be called from process context Laurent reported the enclosed report [1] This bug triggers with following coditions: 0) Kernel built with CONFIG_DEBUG_PREEMPT=y 1) A new passive FastOpen TCP socket is created. This FO socket waits for an ACK coming from client to be a complete ESTABLISHED one. 2) A socket operation on this socket goes through lock_sock() release_sock() dance. 3) While the socket is owned by the user in step 2), a retransmit of the SYN is received and stored in socket backlog. 4) At release_sock() time, the socket backlog is processed while in process context. 5) A SYNACK packet is cooked in response of the SYN retransmit. 6) -> tcp_rtx_synack() is called in process context. Before blamed commit, tcp_rtx_synack() was always called from BH handler, from a timer handler. Fix this by using TCP_INC_STATS() & NET_INC_STATS() which do not assume caller is in non preemptible context. [1] BUG: using __this_cpu_add() in preemptible [00000000] code: epollpep/2180 caller is tcp_rtx_synack.part.0+0x36/0xc0 CPU: 10 PID: 2180 Comm: epollpep Tainted: G OE 5.16.0-0.bpo.4-amd64 #1 Debian 5.16.12-1~bpo11+1 Hardware name: Supermicro SYS-5039MC-H8TRF/X11SCD-F, BIOS 1.7 11/23/2021 Call Trace: <TASK> dump_stack_lvl+0x48/0x5e check_preemption_disabled+0xde/0xe0 tcp_rtx_synack.part.0+0x36/0xc0 tcp_rtx_synack+0x8d/0xa0 ? kmem_cache_alloc+0x2e0/0x3e0 ? apparmor_file_alloc_security+0x3b/0x1f0 inet_rtx_syn_ack+0x16/0x30 tcp_check_req+0x367/0x610 tcp_rcv_state_process+0x91/0xf60 ? get_nohz_timer_target+0x18/0x1a0 ? lock_timer_base+0x61/0x80 ? preempt_count_add+0x68/0xa0 tcp_v4_do_rcv+0xbd/0x270 __release_sock+0x6d/0xb0 release_sock+0x2b/0x90 sock_setsockopt+0x138/0x1140 ? __sys_getsockname+0x7e/0xc0 ? aa_sk_perm+0x3e/0x1a0 __sys_setsockopt+0x198/0x1e0 __x64_sys_setsockopt+0x21/0x30 do_syscall_64+0x38/0xc0 entry_SYSCALL_64_after_hwframe+0x44/0xae
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://git.kernel.org/stable/c/0a0f7f84148445c9f02f226928803a870139d820 URL:https://git.kernel.org/stable/c/0a0f7f84148445c9f02f226928803a870139d820 MISC:https://git.kernel.org/stable/c/0a375c822497ed6ad6b5da0792a12a6f1af10c0b URL:https://git.kernel.org/stable/c/0a375c822497ed6ad6b5da0792a12a6f1af10c0b MISC:https://git.kernel.org/stable/c/3db889f883e65bbd3b1401279bfc1e9ed255c481 URL:https://git.kernel.org/stable/c/3db889f883e65bbd3b1401279bfc1e9ed255c481 MISC:https://git.kernel.org/stable/c/58bd38cbc961fd799842b7be8c5222310f04b908 URL:https://git.kernel.org/stable/c/58bd38cbc961fd799842b7be8c5222310f04b908 MISC:https://git.kernel.org/stable/c/88cd232146207ff1d41dededed5e77c0d4438113 URL:https://git.kernel.org/stable/c/88cd232146207ff1d41dededed5e77c0d4438113 MISC:https://git.kernel.org/stable/c/bdc28a8fb43cc476e33b11519235adb816ce00e8 URL:https://git.kernel.org/stable/c/bdc28a8fb43cc476e33b11519235adb816ce00e8 MISC:https://git.kernel.org/stable/c/c348b0f8d035fc4bdc040796889beec7218bd1b8 URL:https://git.kernel.org/stable/c/c348b0f8d035fc4bdc040796889beec7218bd1b8 MISC:https://git.kernel.org/stable/c/d05c2fdf8e10528bb6751bd95243e862d5402a9b URL:https://git.kernel.org/stable/c/d05c2fdf8e10528bb6751bd95243e862d5402a9b MISC:https://git.kernel.org/stable/c/d8e1bc6029acac796293310aacef7b7336f35b6a URL:https://git.kernel.org/stable/c/d8e1bc6029acac796293310aacef7b7336f35b6a
Assigning CNA
kernel.org
Date Record Created
20250226	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20250226)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)