CVE-2022-50536

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data

In tcp_bpf_send_verdict() redirection, the eval variable is assigned to

__SK_REDIRECT after the apply_bytes data is sent, if msg has more_data,

sock_put() will be called multiple times.

We should reset the eval variable to __SK_NONE every time more_data

starts.

This causes:

IPv4: Attempt to release TCP socket in state 1 00000000b4c925d7

------------[ cut here ]------------

refcount_t: addition on 0; use-after-free.

WARNING: CPU: 5 PID: 4482 at lib/refcount.c:25 refcount_warn_saturate+0x7d/0x110

Modules linked in:

CPU: 5 PID: 4482 Comm: sockhash_bypass Kdump: loaded Not tainted 6.0.0 #1

Hardware name: Red Hat KVM, BIOS 1.11.0-2.el7 04/01/2014

Call Trace:

<TASK>

__tcp_transmit_skb+0xa1b/0xb90

? __alloc_skb+0x8c/0x1a0

? __kmalloc_node_track_caller+0x184/0x320

tcp_write_xmit+0x22a/0x1110

__tcp_push_pending_frames+0x32/0xf0

do_tcp_sendpages+0x

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References