Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2022-49372— tcp: tcp_rtx_synack() can be called from process context

AI Predicted 5.5 Difficulty: Theoretical EPSS 0.29% · P22

Possible ATT&CK Techniques 1AI

T1203 · Exploitation for Client Execution

Affected Version Matrix 20

VendorProductVersion RangeStatus
LinuxLinux168a8f58059a22feb9e9a2dcc1b8053dbbbc12ef< 3db889f883e65bbd3b1401279bfc1e9ed255c481affected
168a8f58059a22feb9e9a2dcc1b8053dbbbc12ef< c348b0f8d035fc4bdc040796889beec7218bd1b8affected
168a8f58059a22feb9e9a2dcc1b8053dbbbc12ef< 58bd38cbc961fd799842b7be8c5222310f04b908affected
168a8f58059a22feb9e9a2dcc1b8053dbbbc12ef< d05c2fdf8e10528bb6751bd95243e862d5402a9baffected
168a8f58059a22feb9e9a2dcc1b8053dbbbc12ef< 0a0f7f84148445c9f02f226928803a870139d820affected
168a8f58059a22feb9e9a2dcc1b8053dbbbc12ef< 88cd232146207ff1d41dededed5e77c0d4438113affected
168a8f58059a22feb9e9a2dcc1b8053dbbbc12ef< bdc28a8fb43cc476e33b11519235adb816ce00e8affected
168a8f58059a22feb9e9a2dcc1b8053dbbbc12ef< d8e1bc6029acac796293310aacef7b7336f35b6aaffected
… +12 more rows
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2022-49372

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
tcp: tcp_rtx_synack() can be called from process context
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: tcp: tcp_rtx_synack() can be called from process context Laurent reported the enclosed report [1] This bug triggers with following coditions: 0) Kernel built with CONFIG_DEBUG_PREEMPT=y 1) A new passive FastOpen TCP socket is created. This FO socket waits for an ACK coming from client to be a complete ESTABLISHED one. 2) A socket operation on this socket goes through lock_sock() release_sock() dance. 3) While the socket is owned by the user in step 2), a retransmit of the SYN is received and stored in socket backlog. 4) At release_sock() time, the socket backlog is processed while in process context. 5) A SYNACK packet is cooked in response of the SYN retransmit. 6) -> tcp_rtx_synack() is called in process context. Before blamed commit, tcp_rtx_synack() was always called from BH handler, from a timer handler. Fix this by using TCP_INC_STATS() & NET_INC_STATS() which do not assume caller is in non preemptible context. [1] BUG: using __this_cpu_add() in preemptible [00000000] code: epollpep/2180 caller is tcp_rtx_synack.part.0+0x36/0xc0 CPU: 10 PID: 2180 Comm: epollpep Tainted: G OE 5.16.0-0.bpo.4-amd64 #1 Debian 5.16.12-1~bpo11+1 Hardware name: Supermicro SYS-5039MC-H8TRF/X11SCD-F, BIOS 1.7 11/23/2021 Call Trace: <TASK> dump_stack_lvl+0x48/0x5e check_preemption_disabled+0xde/0xe0 tcp_rtx_synack.part.0+0x36/0xc0 tcp_rtx_synack+0x8d/0xa0 ? kmem_cache_alloc+0x2e0/0x3e0 ? apparmor_file_alloc_security+0x3b/0x1f0 inet_rtx_syn_ack+0x16/0x30 tcp_check_req+0x367/0x610 tcp_rcv_state_process+0x91/0xf60 ? get_nohz_timer_target+0x18/0x1a0 ? lock_timer_base+0x61/0x80 ? preempt_count_add+0x68/0xa0 tcp_v4_do_rcv+0xbd/0x270 __release_sock+0x6d/0xb0 release_sock+0x2b/0x90 sock_setsockopt+0x138/0x1140 ? __sys_getsockname+0x7e/0xc0 ? aa_sk_perm+0x3e/0x1a0 __sys_setsockopt+0x198/0x1e0 __x64_sys_setsockopt+0x21/0x30 do_syscall_64+0x38/0xc0 entry_SYSCALL_64_after_hwframe+0x44/0xae
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于tcp_rtx_synack函数可能在进程环境中调用，导致统计函数错误。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
LinuxLinux 168a8f58059a22feb9e9a2dcc1b8053dbbbc12ef ~ 3db889f883e65bbd3b1401279bfc1e9ed255c481 -
LinuxLinux 3.7 -

II. Public POCs for CVE-2022-49372

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2022-49372

请登录查看更多情报信息。

Patches & Fixes for CVE-2022-49372 (9)

Same Patch Batch · Linux · 2025-02-26 · 706 CVEs total

CVE-2022-495619.8 CRITICALnetfilter: conntrack: re-fetch conntrack after insertion
CVE-2022-491499.8 CRITICALrxrpc: Fix call timer start racing with call destruction
CVE-2022-494079.8 CRITICALdlm: fix plock invalid read
CVE-2022-493569.8 CRITICALSUNRPC: Trap RDMA segment overflows
CVE-2022-493629.8 CRITICALNFSD: Fix potential use-after-free in nfsd_file_put()
CVE-2022-492809.8 CRITICALNFSD: prevent underflow in nfssvc_decode_writeargs()
CVE-2022-492609.8 CRITICALcrypto: hisilicon/sec - fix the aead software fallback for engine
CVE-2022-494189.8 CRITICALNFSv4: Fix free of uninitialized nfs4_label on referral lookup.
CVE-2022-492019.8 CRITICALibmvnic: fix race between xmit and reset
CVE-2022-491949.8 CRITICALnet: bcmgenet: Use stronger register read/writes to assure ordering
CVE-2022-490939.8 CRITICALskbuff: fix coalescing for page_pool fragment recycling
CVE-2022-490949.8 CRITICALnet/tls: fix slab-out-of-bounds bug in decrypt_internal
CVE-2022-490589.1 CRITICALcifs: potential buffer overflow in handling symlinks
CVE-2022-494168.8 HIGHwifi: mac80211: fix use-after-free in chanctx code
CVE-2022-495358.8 HIGHscsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI
CVE-2022-492388.8 HIGHath11k: free peer for station when disconnect from AP for QCA6390/WCN6855
CVE-2022-495198.8 HIGHath10k: skip ath10k_halt during suspend for driver state RESTARTING
CVE-2022-491388.8 HIGHBluetooth: hci_event: Ignore multiple conn complete events
CVE-2022-494718.8 HIGHrtw89: cfo: check mac_id to avoid out-of-bounds
CVE-2022-491598.8 HIGHscsi: qla2xxx: Implement ref count for SRB

Showing top 20 of 706 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2022-49372

No comments yet

Leave a comment