PT-2022-7619 · Linux+2 · Linux Kernel+2
Published
2022-02-24
·
Updated
2024-09-27
·
CVE-2022-48906
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 5.17.1
Description
A vulnerability in the Linux kernel's MPTCP component has been identified, where a large number of DATA FIN retransmits can cause a shift-out-of-bounds in the DATA FIN timeout calculation. This issue can lead to a denial of service. The vulnerability was discovered using Syzkaller with UBSAN, which uncovered a scenario where the shift exponent 32 is too large for a 32-bit type 'unsigned int'. The change to resolve this issue limits the maximum timeout by limiting the size of the shift, keeping all intermediate values in-bounds.
Recommendations
To resolve this issue, update the Linux kernel to version 5.17.1 or later.
As a temporary workaround, consider disabling the
mptcp set datafin timeout function until a patch is available.
Restrict access to the MPTCP component to minimize the risk of exploitation.
Avoid using the DATA FIN retransmit feature in the affected API endpoint until the issue is resolved.Exploit
Fix
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linux Kernel
Red Os
Suse