CVE-2022-49450 (GCVE-0-2022-49450)
Vulnerability from cvelistv5 – Published: 2025-02-26 02:13 – Updated: 2025-10-01 19:46
VLAI?
Title
rxrpc: Fix listen() setting the bar too high for the prealloc rings
Summary
In the Linux kernel, the following vulnerability has been resolved:
rxrpc: Fix listen() setting the bar too high for the prealloc rings
AF_RXRPC's listen() handler lets you set the backlog up to 32 (if you bump
up the sysctl), but whilst the preallocation circular buffers have 32 slots
in them, one of them has to be a dead slot because we're using CIRC_CNT().
This means that listen(rxrpc_sock, 32) will cause an oops when the socket
is closed because rxrpc_service_prealloc_one() allocated one too many calls
and rxrpc_discard_prealloc() won't then be able to get rid of them because
it'll think the ring is empty. rxrpc_release_calls_on_socket() then tries
to abort them, but oopses because call->peer isn't yet set.
Fix this by setting the maximum backlog to RXRPC_BACKLOG_MAX - 1 to match
the ring capacity.
BUG: kernel NULL pointer dereference, address: 0000000000000086
...
RIP: 0010:rxrpc_send_abort_packet+0x73/0x240 [rxrpc]
Call Trace:
<TASK>
? __wake_up_common_lock+0x7a/0x90
? rxrpc_notify_socket+0x8e/0x140 [rxrpc]
? rxrpc_abort_call+0x4c/0x60 [rxrpc]
rxrpc_release_calls_on_socket+0x107/0x1a0 [rxrpc]
rxrpc_release+0xc9/0x1c0 [rxrpc]
__sock_release+0x37/0xa0
sock_close+0x11/0x20
__fput+0x89/0x240
task_work_run+0x59/0x90
do_exit+0x319/0xaa0
Severity ?
5.5 (Medium)
CWE
- CWE-476 - NULL Pointer Dereference
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
00e907127e6f86d0f9b122d9b4347a8aa09a8b61 , < 61fb38cfbb1d54d3dafd0c25752f684b3cd00b32
(git)
Affected: 00e907127e6f86d0f9b122d9b4347a8aa09a8b61 , < 616f76498d5ddf26b997caf64a95cda3c8a55533 (git) Affected: 00e907127e6f86d0f9b122d9b4347a8aa09a8b61 , < 4a3a78b7918bdd723d8c7c9786522ca969bffcc4 (git) Affected: 00e907127e6f86d0f9b122d9b4347a8aa09a8b61 , < 91b34bf0409f43bb60453bab23c5beadd726d022 (git) Affected: 00e907127e6f86d0f9b122d9b4347a8aa09a8b61 , < 5b4826657d36c218e9f08e8d3223b0edce3de88f (git) Affected: 00e907127e6f86d0f9b122d9b4347a8aa09a8b61 , < b3a9b227d5e7467b8518160ff034ea22bb9de573 (git) Affected: 00e907127e6f86d0f9b122d9b4347a8aa09a8b61 , < 369de57492c4f1a42563c5a3bd365822ca3bfc79 (git) Affected: 00e907127e6f86d0f9b122d9b4347a8aa09a8b61 , < e198f1930050e3115c80b67d9249f80f98a27c67 (git) Affected: 00e907127e6f86d0f9b122d9b4347a8aa09a8b61 , < 88e22159750b0d55793302eeed8ee603f5c1a95c (git) |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2022-49450",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-01T19:40:32.763863Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "CWE-476 NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-01T19:46:48.225Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/rxrpc/sysctl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "61fb38cfbb1d54d3dafd0c25752f684b3cd00b32",
"status": "affected",
"version": "00e907127e6f86d0f9b122d9b4347a8aa09a8b61",
"versionType": "git"
},
{
"lessThan": "616f76498d5ddf26b997caf64a95cda3c8a55533",
"status": "affected",
"version": "00e907127e6f86d0f9b122d9b4347a8aa09a8b61",
"versionType": "git"
},
{
"lessThan": "4a3a78b7918bdd723d8c7c9786522ca969bffcc4",
"status": "affected",
"version": "00e907127e6f86d0f9b122d9b4347a8aa09a8b61",
"versionType": "git"
},
{
"lessThan": "91b34bf0409f43bb60453bab23c5beadd726d022",
"status": "affected",
"version": "00e907127e6f86d0f9b122d9b4347a8aa09a8b61",
"versionType": "git"
},
{
"lessThan": "5b4826657d36c218e9f08e8d3223b0edce3de88f",
"status": "affected",
"version": "00e907127e6f86d0f9b122d9b4347a8aa09a8b61",
"versionType": "git"
},
{
"lessThan": "b3a9b227d5e7467b8518160ff034ea22bb9de573",
"status": "affected",
"version": "00e907127e6f86d0f9b122d9b4347a8aa09a8b61",
"versionType": "git"
},
{
"lessThan": "369de57492c4f1a42563c5a3bd365822ca3bfc79",
"status": "affected",
"version": "00e907127e6f86d0f9b122d9b4347a8aa09a8b61",
"versionType": "git"
},
{
"lessThan": "e198f1930050e3115c80b67d9249f80f98a27c67",
"status": "affected",
"version": "00e907127e6f86d0f9b122d9b4347a8aa09a8b61",
"versionType": "git"
},
{
"lessThan": "88e22159750b0d55793302eeed8ee603f5c1a95c",
"status": "affected",
"version": "00e907127e6f86d0f9b122d9b4347a8aa09a8b61",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/rxrpc/sysctl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.9"
},
{
"lessThan": "4.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.9.*",
"status": "unaffected",
"version": "4.9.318",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.14.*",
"status": "unaffected",
"version": "4.14.283",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.247",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.198",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.121",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.17.*",
"status": "unaffected",
"version": "5.17.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.18.*",
"status": "unaffected",
"version": "5.18.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "5.19",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.318",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.14.283",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.247",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.198",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.121",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.46",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.17.14",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.18.3",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.19",
"versionStartIncluding": "4.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix listen() setting the bar too high for the prealloc rings\n\nAF_RXRPC\u0027s listen() handler lets you set the backlog up to 32 (if you bump\nup the sysctl), but whilst the preallocation circular buffers have 32 slots\nin them, one of them has to be a dead slot because we\u0027re using CIRC_CNT().\n\nThis means that listen(rxrpc_sock, 32) will cause an oops when the socket\nis closed because rxrpc_service_prealloc_one() allocated one too many calls\nand rxrpc_discard_prealloc() won\u0027t then be able to get rid of them because\nit\u0027ll think the ring is empty. rxrpc_release_calls_on_socket() then tries\nto abort them, but oopses because call-\u003epeer isn\u0027t yet set.\n\nFix this by setting the maximum backlog to RXRPC_BACKLOG_MAX - 1 to match\nthe ring capacity.\n\n BUG: kernel NULL pointer dereference, address: 0000000000000086\n ...\n RIP: 0010:rxrpc_send_abort_packet+0x73/0x240 [rxrpc]\n Call Trace:\n \u003cTASK\u003e\n ? __wake_up_common_lock+0x7a/0x90\n ? rxrpc_notify_socket+0x8e/0x140 [rxrpc]\n ? rxrpc_abort_call+0x4c/0x60 [rxrpc]\n rxrpc_release_calls_on_socket+0x107/0x1a0 [rxrpc]\n rxrpc_release+0xc9/0x1c0 [rxrpc]\n __sock_release+0x37/0xa0\n sock_close+0x11/0x20\n __fput+0x89/0x240\n task_work_run+0x59/0x90\n do_exit+0x319/0xaa0"
}
],
"providerMetadata": {
"dateUpdated": "2025-05-04T08:38:00.234Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/61fb38cfbb1d54d3dafd0c25752f684b3cd00b32"
},
{
"url": "https://git.kernel.org/stable/c/616f76498d5ddf26b997caf64a95cda3c8a55533"
},
{
"url": "https://git.kernel.org/stable/c/4a3a78b7918bdd723d8c7c9786522ca969bffcc4"
},
{
"url": "https://git.kernel.org/stable/c/91b34bf0409f43bb60453bab23c5beadd726d022"
},
{
"url": "https://git.kernel.org/stable/c/5b4826657d36c218e9f08e8d3223b0edce3de88f"
},
{
"url": "https://git.kernel.org/stable/c/b3a9b227d5e7467b8518160ff034ea22bb9de573"
},
{
"url": "https://git.kernel.org/stable/c/369de57492c4f1a42563c5a3bd365822ca3bfc79"
},
{
"url": "https://git.kernel.org/stable/c/e198f1930050e3115c80b67d9249f80f98a27c67"
},
{
"url": "https://git.kernel.org/stable/c/88e22159750b0d55793302eeed8ee603f5c1a95c"
}
],
"title": "rxrpc: Fix listen() setting the bar too high for the prealloc rings",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2022-49450",
"datePublished": "2025-02-26T02:13:00.379Z",
"dateReserved": "2025-02-26T02:08:31.572Z",
"dateUpdated": "2025-10-01T19:46:48.225Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2022-49450\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-26T07:01:21.390\",\"lastModified\":\"2025-10-01T20:16:20.803\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nrxrpc: Fix listen() setting the bar too high for the prealloc rings\\n\\nAF_RXRPC\u0027s listen() handler lets you set the backlog up to 32 (if you bump\\nup the sysctl), but whilst the preallocation circular buffers have 32 slots\\nin them, one of them has to be a dead slot because we\u0027re using CIRC_CNT().\\n\\nThis means that listen(rxrpc_sock, 32) will cause an oops when the socket\\nis closed because rxrpc_service_prealloc_one() allocated one too many calls\\nand rxrpc_discard_prealloc() won\u0027t then be able to get rid of them because\\nit\u0027ll think the ring is empty. rxrpc_release_calls_on_socket() then tries\\nto abort them, but oopses because call-\u003epeer isn\u0027t yet set.\\n\\nFix this by setting the maximum backlog to RXRPC_BACKLOG_MAX - 1 to match\\nthe ring capacity.\\n\\n BUG: kernel NULL pointer dereference, address: 0000000000000086\\n ...\\n RIP: 0010:rxrpc_send_abort_packet+0x73/0x240 [rxrpc]\\n Call Trace:\\n \u003cTASK\u003e\\n ? __wake_up_common_lock+0x7a/0x90\\n ? rxrpc_notify_socket+0x8e/0x140 [rxrpc]\\n ? rxrpc_abort_call+0x4c/0x60 [rxrpc]\\n rxrpc_release_calls_on_socket+0x107/0x1a0 [rxrpc]\\n rxrpc_release+0xc9/0x1c0 [rxrpc]\\n __sock_release+0x37/0xa0\\n sock_close+0x11/0x20\\n __fput+0x89/0x240\\n task_work_run+0x59/0x90\\n do_exit+0x319/0xaa0\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: rxrpc: Se corrige que listen() estableciera la barra demasiado alta para los anillos de preasignaci\u00f3n El controlador listen() de AF_RXRPC le permite establecer el backlog hasta 32 (si aumenta el sysctl), pero mientras que los b\u00faferes circulares de preasignaci\u00f3n tienen 32 ranuras en ellos, una de ellas tiene que ser una ranura muerta porque estamos usando CIRC_CNT(). Esto significa que listen(rxrpc_sock, 32) causar\u00e1 un oops cuando el socket se cierre porque rxrpc_service_prealloc_one() asign\u00f3 una llamada de m\u00e1s y rxrpc_discard_prealloc() no podr\u00e1 deshacerse de ellas porque pensar\u00e1 que el anillo est\u00e1 vac\u00edo. rxrpc_release_calls_on_socket() luego intenta abortarlas, pero falla porque call-\u0026gt;peer a\u00fan no est\u00e1 configurado. Solucione esto configurando el backlog m\u00e1ximo en RXRPC_BACKLOG_MAX - 1 para que coincida con la capacidad del anillo. ERROR: desreferencia de puntero NULL del kernel, direcci\u00f3n: 0000000000000086 ... RIP: 0010:rxrpc_send_abort_packet+0x73/0x240 [rxrpc] Call Trace: ? __wake_up_common_lock+0x7a/0x90 ? rxrpc_notify_socket+0x8e/0x140 [rxrpc] ? rxrpc_abort_call+0x4c/0x60 [rxrpc] rxrpc_release_calls_on_socket+0x107/0x1a0 [rxrpc] rxrpc_release+0xc9/0x1c0 [rxrpc] __sock_release+0x37/0xa0 sock_close+0x11/0x20 __fput+0x89/0x240 task_work_run+0x59/0x90 do_exit+0x319/0xaa0 \"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.9\",\"versionEndExcluding\":\"4.9.318\",\"matchCriteriaId\":\"F66DA60C-48FB-4C0A-A8BD-EE00CAEBAAF6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.10\",\"versionEndExcluding\":\"4.14.283\",\"matchCriteriaId\":\"D6823775-2653-4644-A0D4-4E6E68F10C65\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.15\",\"versionEndExcluding\":\"4.19.247\",\"matchCriteriaId\":\"B8CFA0F4-2D75-41F4-9753-87944A08B53B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.198\",\"matchCriteriaId\":\"3EC49633-14DE-4EBD-BB80-76AE2E3EABB9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.121\",\"matchCriteriaId\":\"34ACD872-E5BC-401C-93D5-B357A62426E0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.46\",\"matchCriteriaId\":\"20D41697-0E8B-4B7D-8842-F17BF2AA21E1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.17.14\",\"matchCriteriaId\":\"15E2DD33-2255-4B76-9C15-04FF8CBAB252\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.18\",\"versionEndExcluding\":\"5.18.3\",\"matchCriteriaId\":\"8E122216-2E9E-4B3E-B7B8-D575A45BA3C2\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/369de57492c4f1a42563c5a3bd365822ca3bfc79\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4a3a78b7918bdd723d8c7c9786522ca969bffcc4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5b4826657d36c218e9f08e8d3223b0edce3de88f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/616f76498d5ddf26b997caf64a95cda3c8a55533\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/61fb38cfbb1d54d3dafd0c25752f684b3cd00b32\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/88e22159750b0d55793302eeed8ee603f5c1a95c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/91b34bf0409f43bb60453bab23c5beadd726d022\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b3a9b227d5e7467b8518160ff034ea22bb9de573\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e198f1930050e3115c80b67d9249f80f98a27c67\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
"vulnrichment": {
"containers": "{\"cna\": {\"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T08:38:00.234Z\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nrxrpc: Fix listen() setting the bar too high for the prealloc rings\\n\\nAF_RXRPC\u0027s listen() handler lets you set the backlog up to 32 (if you bump\\nup the sysctl), but whilst the preallocation circular buffers have 32 slots\\nin them, one of them has to be a dead slot because we\u0027re using CIRC_CNT().\\n\\nThis means that listen(rxrpc_sock, 32) will cause an oops when the socket\\nis closed because rxrpc_service_prealloc_one() allocated one too many calls\\nand rxrpc_discard_prealloc() won\u0027t then be able to get rid of them because\\nit\u0027ll think the ring is empty. rxrpc_release_calls_on_socket() then tries\\nto abort them, but oopses because call-\u003epeer isn\u0027t yet set.\\n\\nFix this by setting the maximum backlog to RXRPC_BACKLOG_MAX - 1 to match\\nthe ring capacity.\\n\\n BUG: kernel NULL pointer dereference, address: 0000000000000086\\n ...\\n RIP: 0010:rxrpc_send_abort_packet+0x73/0x240 [rxrpc]\\n Call Trace:\\n \u003cTASK\u003e\\n ? __wake_up_common_lock+0x7a/0x90\\n ? rxrpc_notify_socket+0x8e/0x140 [rxrpc]\\n ? rxrpc_abort_call+0x4c/0x60 [rxrpc]\\n rxrpc_release_calls_on_socket+0x107/0x1a0 [rxrpc]\\n rxrpc_release+0xc9/0x1c0 [rxrpc]\\n __sock_release+0x37/0xa0\\n sock_close+0x11/0x20\\n __fput+0x89/0x240\\n task_work_run+0x59/0x90\\n do_exit+0x319/0xaa0\"}], \"affected\": [{\"product\": \"Linux\", \"vendor\": \"Linux\", \"defaultStatus\": \"unaffected\", \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"programFiles\": [\"net/rxrpc/sysctl.c\"], \"versions\": [{\"version\": \"00e907127e6f86d0f9b122d9b4347a8aa09a8b61\", \"lessThan\": \"61fb38cfbb1d54d3dafd0c25752f684b3cd00b32\", \"status\": \"affected\", \"versionType\": \"git\"}, {\"version\": \"00e907127e6f86d0f9b122d9b4347a8aa09a8b61\", \"lessThan\": \"616f76498d5ddf26b997caf64a95cda3c8a55533\", \"status\": \"affected\", \"versionType\": \"git\"}, {\"version\": \"00e907127e6f86d0f9b122d9b4347a8aa09a8b61\", \"lessThan\": \"4a3a78b7918bdd723d8c7c9786522ca969bffcc4\", \"status\": \"affected\", \"versionType\": \"git\"}, {\"version\": \"00e907127e6f86d0f9b122d9b4347a8aa09a8b61\", \"lessThan\": \"91b34bf0409f43bb60453bab23c5beadd726d022\", \"status\": \"affected\", \"versionType\": \"git\"}, {\"version\": \"00e907127e6f86d0f9b122d9b4347a8aa09a8b61\", \"lessThan\": \"5b4826657d36c218e9f08e8d3223b0edce3de88f\", \"status\": \"affected\", \"versionType\": \"git\"}, {\"version\": \"00e907127e6f86d0f9b122d9b4347a8aa09a8b61\", \"lessThan\": \"b3a9b227d5e7467b8518160ff034ea22bb9de573\", \"status\": \"affected\", \"versionType\": \"git\"}, {\"version\": \"00e907127e6f86d0f9b122d9b4347a8aa09a8b61\", \"lessThan\": \"369de57492c4f1a42563c5a3bd365822ca3bfc79\", \"status\": \"affected\", \"versionType\": \"git\"}, {\"version\": \"00e907127e6f86d0f9b122d9b4347a8aa09a8b61\", \"lessThan\": \"e198f1930050e3115c80b67d9249f80f98a27c67\", \"status\": \"affected\", \"versionType\": \"git\"}, {\"version\": \"00e907127e6f86d0f9b122d9b4347a8aa09a8b61\", \"lessThan\": \"88e22159750b0d55793302eeed8ee603f5c1a95c\", \"status\": \"affected\", \"versionType\": \"git\"}]}, {\"product\": \"Linux\", \"vendor\": \"Linux\", \"defaultStatus\": \"affected\", \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"programFiles\": [\"net/rxrpc/sysctl.c\"], \"versions\": [{\"version\": \"4.9\", \"status\": \"affected\"}, {\"version\": \"0\", \"lessThan\": \"4.9\", \"status\": \"unaffected\", \"versionType\": \"semver\"}, {\"version\": \"4.9.318\", \"lessThanOrEqual\": \"4.9.*\", \"status\": \"unaffected\", \"versionType\": \"semver\"}, {\"version\": \"4.14.283\", \"lessThanOrEqual\": \"4.14.*\", \"status\": \"unaffected\", \"versionType\": \"semver\"}, {\"version\": \"4.19.247\", \"lessThanOrEqual\": \"4.19.*\", \"status\": \"unaffected\", \"versionType\": \"semver\"}, {\"version\": \"5.4.198\", \"lessThanOrEqual\": \"5.4.*\", \"status\": \"unaffected\", \"versionType\": \"semver\"}, {\"version\": \"5.10.121\", \"lessThanOrEqual\": \"5.10.*\", \"status\": \"unaffected\", \"versionType\": \"semver\"}, {\"version\": \"5.15.46\", \"lessThanOrEqual\": \"5.15.*\", \"status\": \"unaffected\", \"versionType\": \"semver\"}, {\"version\": \"5.17.14\", \"lessThanOrEqual\": \"5.17.*\", \"status\": \"unaffected\", \"versionType\": \"semver\"}, {\"version\": \"5.18.3\", \"lessThanOrEqual\": \"5.18.*\", \"status\": \"unaffected\", \"versionType\": \"semver\"}, {\"version\": \"5.19\", \"lessThanOrEqual\": \"*\", \"status\": \"unaffected\", \"versionType\": \"original_commit_for_fix\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.9\", \"versionEndExcluding\": \"4.9.318\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.9\", \"versionEndExcluding\": \"4.14.283\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.9\", \"versionEndExcluding\": \"4.19.247\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.9\", \"versionEndExcluding\": \"5.4.198\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.9\", \"versionEndExcluding\": \"5.10.121\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.9\", \"versionEndExcluding\": \"5.15.46\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.9\", \"versionEndExcluding\": \"5.17.14\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.9\", \"versionEndExcluding\": \"5.18.3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.9\", \"versionEndExcluding\": \"5.19\"}]}]}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/61fb38cfbb1d54d3dafd0c25752f684b3cd00b32\"}, {\"url\": \"https://git.kernel.org/stable/c/616f76498d5ddf26b997caf64a95cda3c8a55533\"}, {\"url\": \"https://git.kernel.org/stable/c/4a3a78b7918bdd723d8c7c9786522ca969bffcc4\"}, {\"url\": \"https://git.kernel.org/stable/c/91b34bf0409f43bb60453bab23c5beadd726d022\"}, {\"url\": \"https://git.kernel.org/stable/c/5b4826657d36c218e9f08e8d3223b0edce3de88f\"}, {\"url\": \"https://git.kernel.org/stable/c/b3a9b227d5e7467b8518160ff034ea22bb9de573\"}, {\"url\": \"https://git.kernel.org/stable/c/369de57492c4f1a42563c5a3bd365822ca3bfc79\"}, {\"url\": \"https://git.kernel.org/stable/c/e198f1930050e3115c80b67d9249f80f98a27c67\"}, {\"url\": \"https://git.kernel.org/stable/c/88e22159750b0d55793302eeed8ee603f5c1a95c\"}], \"title\": \"rxrpc: Fix listen() setting the bar too high for the prealloc rings\", \"x_generator\": {\"engine\": \"bippy-1.2.0\"}}, \"adp\": [{\"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-49450\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T19:40:32.763863Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-476\", \"description\": \"CWE-476 NULL Pointer Dereference\"}]}], \"providerMetadata\": {\"shortName\": \"CISA-ADP\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"dateUpdated\": \"2025-10-01T16:47:21.266Z\"}, \"title\": \"CISA ADP Vulnrichment\"}]}",
"cveMetadata": "{\"cveId\": \"CVE-2022-49450\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"Linux\", \"dateReserved\": \"2025-02-26T02:08:31.572Z\", \"datePublished\": \"2025-02-26T02:13:00.379Z\", \"dateUpdated\": \"2025-05-04T08:38:00.234Z\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…