CVE-2022-49998

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: Fix locking in rxrpc's sendmsg

Fix three bugs in the rxrpc's sendmsg implementation:

(1) rxrpc_new_client_call() should release the socket lock when returning

an error from rxrpc_get_call_slot().

(2) rxrpc_wait_for_tx_window_intr() will return without the call mutex

held in the event that we're interrupted by a signal whilst waiting

for tx space on the socket or relocking the call mutex afterwards.

Fix this by: (a) moving the unlock/lock of the call mutex up to

rxrpc_send_data() such that the lock is not held around all of

rxrpc_wait_for_tx_window*() and (b) indicating to higher callers

whether we're return with the lock dropped. Note that this means

recvmsg() will not block on this call whilst we're waiting.

(3) After dropping and regaining the call mutex, rxrpc_send_data() needs

to go and recheck the state of the tx_pending buffer and the

tx_total_len

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References