CVE-2022-49209

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf, sockmap: Fix memleak in tcp_bpf_sendmsg while sk msg is full

If tcp_bpf_sendmsg() is running while sk msg is full. When sk_msg_alloc()

returns -ENOMEM error, tcp_bpf_sendmsg() goes to wait_for_memory. If partial

memory has been alloced by sk_msg_alloc(), that is, msg_tx->sg.size is

greater than osize after sk_msg_alloc(), memleak occurs. To fix we use

sk_msg_trim() to release the allocated memory, then goto wait for memory.

Other call paths of sk_msg_alloc() have the similar issue, such as

tls_sw_sendmsg(), so handle sk_msg_trim logic inside sk_msg_alloc(),

as Cong Wang suggested.

This issue can cause the following info:

WARNING: CPU: 3 PID: 7950 at net/core/stream.c:208 sk_stream_kill_queues+0xd4/0x1a0

Call Trace:

<TASK>

inet_csk_destroy_sock+0x55/0x110

__tcp_close+0x279/0x470

tcp_close+0x1f/0x60

inet_release+0x3f/0x80

__sock_release+0x3d/0xb0

sock_close+0x11/0x20

__fput+0x92/0x250

task_work_run+0x6a

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References