CVE-2022-50070

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mptcp: do not queue data on closed subflows

Dipanjan reported a syzbot splat at close time:

WARNING: CPU: 1 PID: 10818 at net/ipv4/af_inet.c:153

inet_sock_destruct+0x6d0/0x8e0 net/ipv4/af_inet.c:153

Modules linked in: uio_ivshmem(OE) uio(E)

CPU: 1 PID: 10818 Comm: kworker/1:16 Tainted: G OE

5.19.0-rc6-g2eae0556bb9d #2

Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS

1.13.0-1ubuntu1.1 04/01/2014

Workqueue: events mptcp_worker

RIP: 0010:inet_sock_destruct+0x6d0/0x8e0 net/ipv4/af_inet.c:153

Code: 21 02 00 00 41 8b 9c 24 28 02 00 00 e9 07 ff ff ff e8 34 4d 91

f9 89 ee 4c 89 e7 e8 4a 47 60 ff e9 a6 fc ff ff e8 20 4d 91 f9 <0f> 0b

e9 84 fe ff ff e8 14 4d 91 f9 0f 0b e9 d4 fd ff ff e8 08 4d

RSP: 0018:ffffc9001b35fa78 EFLAGS: 00010246

RAX: 0000000000000000 RBX: 00000000002879d0 RCX: ffff8881326f3b00

RDX: 0000000000000000 RSI: ffff8881326f3b00 RDI: 0000000000000002

RBP: ffff888179662674 R08: ffffffff87e9

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References