{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2022-49450", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-02-26T02:08:31.572Z", "datePublished": "2025-02-26T02:13:00.379Z", "dateUpdated": "2025-02-26T02:13:00.379Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2025-02-26T02:13:00.379Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix listen() setting the bar too high for the prealloc rings\n\nAF_RXRPC's listen() handler lets you set the backlog up to 32 (if you bump\nup the sysctl), but whilst the preallocation circular buffers have 32 slots\nin them, one of them has to be a dead slot because we're using CIRC_CNT().\n\nThis means that listen(rxrpc_sock, 32) will cause an oops when the socket\nis closed because rxrpc_service_prealloc_one() allocated one too many calls\nand rxrpc_discard_prealloc() won't then be able to get rid of them because\nit'll think the ring is empty. rxrpc_release_calls_on_socket() then tries\nto abort them, but oopses because call->peer isn't yet set.\n\nFix this by setting the maximum backlog to RXRPC_BACKLOG_MAX - 1 to match\nthe ring capacity.\n\n BUG: kernel NULL pointer dereference, address: 0000000000000086\n ...\n RIP: 0010:rxrpc_send_abort_packet+0x73/0x240 [rxrpc]\n Call Trace:\n <TASK>\n ? __wake_up_common_lock+0x7a/0x90\n ? rxrpc_notify_socket+0x8e/0x140 [rxrpc]\n ? rxrpc_abort_call+0x4c/0x60 [rxrpc]\n rxrpc_release_calls_on_socket+0x107/0x1a0 [rxrpc]\n rxrpc_release+0xc9/0x1c0 [rxrpc]\n __sock_release+0x37/0xa0\n sock_close+0x11/0x20\n __fput+0x89/0x240\n task_work_run+0x59/0x90\n do_exit+0x319/0xaa0"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/rxrpc/sysctl.c"], "versions": [{"version": "00e907127e6f86d0f9b122d9b4347a8aa09a8b61", "lessThan": "61fb38cfbb1d54d3dafd0c25752f684b3cd00b32", "status": "affected", "versionType": "git"}, {"version": "00e907127e6f86d0f9b122d9b4347a8aa09a8b61", "lessThan": "616f76498d5ddf26b997caf64a95cda3c8a55533", "status": "affected", "versionType": "git"}, {"version": "00e907127e6f86d0f9b122d9b4347a8aa09a8b61", "lessThan": "4a3a78b7918bdd723d8c7c9786522ca969bffcc4", "status": "affected", "versionType": "git"}, {"version": "00e907127e6f86d0f9b122d9b4347a8aa09a8b61", "lessThan": "91b34bf0409f43bb60453bab23c5beadd726d022", "status": "affected", "versionType": "git"}, {"version": "00e907127e6f86d0f9b122d9b4347a8aa09a8b61", "lessThan": "5b4826657d36c218e9f08e8d3223b0edce3de88f", "status": "affected", "versionType": "git"}, {"version": "00e907127e6f86d0f9b122d9b4347a8aa09a8b61", "lessThan": "b3a9b227d5e7467b8518160ff034ea22bb9de573", "status": "affected", "versionType": "git"}, {"version": "00e907127e6f86d0f9b122d9b4347a8aa09a8b61", "lessThan": "369de57492c4f1a42563c5a3bd365822ca3bfc79", "status": "affected", "versionType": "git"}, {"version": "00e907127e6f86d0f9b122d9b4347a8aa09a8b61", "lessThan": "e198f1930050e3115c80b67d9249f80f98a27c67", "status": "affected", "versionType": "git"}, {"version": "00e907127e6f86d0f9b122d9b4347a8aa09a8b61", "lessThan": "88e22159750b0d55793302eeed8ee603f5c1a95c", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/rxrpc/sysctl.c"], "versions": [{"version": "4.9", "status": "affected"}, {"version": "0", "lessThan": "4.9", "status": "unaffected", "versionType": "semver"}, {"version": "4.9.318", "lessThanOrEqual": "4.9.*", "status": "unaffected", "versionType": "semver"}, {"version": "4.14.283", "lessThanOrEqual": "4.14.*", "status": "unaffected", "versionType": "semver"}, {"version": "4.19.247", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.198", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.121", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.46", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.17.14", "lessThanOrEqual": "5.17.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.18.3", "lessThanOrEqual": "5.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.19", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/61fb38cfbb1d54d3dafd0c25752f684b3cd00b32"}, {"url": "https://git.kernel.org/stable/c/616f76498d5ddf26b997caf64a95cda3c8a55533"}, {"url": "https://git.kernel.org/stable/c/4a3a78b7918bdd723d8c7c9786522ca969bffcc4"}, {"url": "https://git.kernel.org/stable/c/91b34bf0409f43bb60453bab23c5beadd726d022"}, {"url": "https://git.kernel.org/stable/c/5b4826657d36c218e9f08e8d3223b0edce3de88f"}, {"url": "https://git.kernel.org/stable/c/b3a9b227d5e7467b8518160ff034ea22bb9de573"}, {"url": "https://git.kernel.org/stable/c/369de57492c4f1a42563c5a3bd365822ca3bfc79"}, {"url": "https://git.kernel.org/stable/c/e198f1930050e3115c80b67d9249f80f98a27c67"}, {"url": "https://git.kernel.org/stable/c/88e22159750b0d55793302eeed8ee603f5c1a95c"}], "title": "rxrpc: Fix listen() setting the bar too high for the prealloc rings", "x_generator": {"engine": "bippy-5f407fcff5a0"}}}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F66DA60C-48FB-4C0A-A8BD-EE00CAEBAAF6", "versionEndExcluding": "4.9.318", "versionStartIncluding": "4.9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D6823775-2653-4644-A0D4-4E6E68F10C65", "versionEndExcluding": "4.14.283", "versionStartIncluding": "4.10", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B8CFA0F4-2D75-41F4-9753-87944A08B53B", "versionEndExcluding": "4.19.247", "versionStartIncluding": "4.15", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "3EC49633-14DE-4EBD-BB80-76AE2E3EABB9", "versionEndExcluding": "5.4.198", "versionStartIncluding": "4.20", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "34ACD872-E5BC-401C-93D5-B357A62426E0", "versionEndExcluding": "5.10.121", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "20D41697-0E8B-4B7D-8842-F17BF2AA21E1", "versionEndExcluding": "5.15.46", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "15E2DD33-2255-4B76-9C15-04FF8CBAB252", "versionEndExcluding": "5.17.14", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "8E122216-2E9E-4B3E-B7B8-D575A45BA3C2", "versionEndExcluding": "5.18.3", "versionStartIncluding": "5.18", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix listen() setting the bar too high for the prealloc rings\n\nAF_RXRPC's listen() handler lets you set the backlog up to 32 (if you bump\nup the sysctl), but whilst the preallocation circular buffers have 32 slots\nin them, one of them has to be a dead slot because we're using CIRC_CNT().\n\nThis means that listen(rxrpc_sock, 32) will cause an oops when the socket\nis closed because rxrpc_service_prealloc_one() allocated one too many calls\nand rxrpc_discard_prealloc() won't then be able to get rid of them because\nit'll think the ring is empty. rxrpc_release_calls_on_socket() then tries\nto abort them, but oopses because call->peer isn't yet set.\n\nFix this by setting the maximum backlog to RXRPC_BACKLOG_MAX - 1 to match\nthe ring capacity.\n\n BUG: kernel NULL pointer dereference, address: 0000000000000086\n ...\n RIP: 0010:rxrpc_send_abort_packet+0x73/0x240 [rxrpc]\n Call Trace:\n <TASK>\n ? __wake_up_common_lock+0x7a/0x90\n ? rxrpc_notify_socket+0x8e/0x140 [rxrpc]\n ? rxrpc_abort_call+0x4c/0x60 [rxrpc]\n rxrpc_release_calls_on_socket+0x107/0x1a0 [rxrpc]\n rxrpc_release+0xc9/0x1c0 [rxrpc]\n __sock_release+0x37/0xa0\n sock_close+0x11/0x20\n __fput+0x89/0x240\n task_work_run+0x59/0x90\n do_exit+0x319/0xaa0"}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: rxrpc: Se corrige que listen() estableciera la barra demasiado alta para los anillos de preasignaci\u00f3n El controlador listen() de AF_RXRPC le permite establecer el backlog hasta 32 (si aumenta el sysctl), pero mientras que los b\u00faferes circulares de preasignaci\u00f3n tienen 32 ranuras en ellos, una de ellas tiene que ser una ranura muerta porque estamos usando CIRC_CNT(). Esto significa que listen(rxrpc_sock, 32) causar\u00e1 un oops cuando el socket se cierre porque rxrpc_service_prealloc_one() asign\u00f3 una llamada de m\u00e1s y rxrpc_discard_prealloc() no podr\u00e1 deshacerse de ellas porque pensar\u00e1 que el anillo est\u00e1 vac\u00edo. rxrpc_release_calls_on_socket() luego intenta abortarlas, pero falla porque call-&gt;peer a\u00fan no est\u00e1 configurado. Solucione esto configurando el backlog m\u00e1ximo en RXRPC_BACKLOG_MAX - 1 para que coincida con la capacidad del anillo. ERROR: desreferencia de puntero NULL del kernel, direcci\u00f3n: 0000000000000086 ... RIP: 0010:rxrpc_send_abort_packet+0x73/0x240 [rxrpc] Call Trace: ? __wake_up_common_lock+0x7a/0x90 ? rxrpc_notify_socket+0x8e/0x140 [rxrpc] ? rxrpc_abort_call+0x4c/0x60 [rxrpc] rxrpc_release_calls_on_socket+0x107/0x1a0 [rxrpc] rxrpc_release+0xc9/0x1c0 [rxrpc] __sock_release+0x37/0xa0 sock_close+0x11/0x20 __fput+0x89/0x240 task_work_run+0x59/0x90 do_exit+0x319/0xaa0 "}], "id": "CVE-2022-49450", "lastModified": "2025-03-17T16:12:16.943", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-02-26T07:01:21.390", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/369de57492c4f1a42563c5a3bd365822ca3bfc79"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4a3a78b7918bdd723d8c7c9786522ca969bffcc4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5b4826657d36c218e9f08e8d3223b0edce3de88f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/616f76498d5ddf26b997caf64a95cda3c8a55533"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/61fb38cfbb1d54d3dafd0c25752f684b3cd00b32"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/88e22159750b0d55793302eeed8ee603f5c1a95c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/91b34bf0409f43bb60453bab23c5beadd726d022"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b3a9b227d5e7467b8518160ff034ea22bb9de573"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e198f1930050e3115c80b67d9249f80f98a27c67"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: rxrpc: Fix listen() setting the bar too high for the prealloc rings", "id": "2347698", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2347698"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nrxrpc: Fix listen() setting the bar too high for the prealloc rings\nAF_RXRPC's listen() handler lets you set the backlog up to 32 (if you bump\nup the sysctl), but whilst the preallocation circular buffers have 32 slots\nin them, one of them has to be a dead slot because we're using CIRC_CNT().\nThis means that listen(rxrpc_sock, 32) will cause an oops when the socket\nis closed because rxrpc_service_prealloc_one() allocated one too many calls\nand rxrpc_discard_prealloc() won't then be able to get rid of them because\nit'll think the ring is empty. rxrpc_release_calls_on_socket() then tries\nto abort them, but oopses because call->peer isn't yet set.\nFix this by setting the maximum backlog to RXRPC_BACKLOG_MAX - 1 to match\nthe ring capacity.\nBUG: kernel NULL pointer dereference, address: 0000000000000086\n...\nRIP: 0010:rxrpc_send_abort_packet+0x73/0x240 [rxrpc]\nCall Trace:\n<TASK>\n? __wake_up_common_lock+0x7a/0x90\n? rxrpc_notify_socket+0x8e/0x140 [rxrpc]\n? rxrpc_abort_call+0x4c/0x60 [rxrpc]\nrxrpc_release_calls_on_socket+0x107/0x1a0 [rxrpc]\nrxrpc_release+0xc9/0x1c0 [rxrpc]\n__sock_release+0x37/0xa0\nsock_close+0x11/0x20\n__fput+0x89/0x240\ntask_work_run+0x59/0x90\ndo_exit+0x319/0xaa0"], "name": "CVE-2022-49450", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-02-26T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2022-49450\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-49450\nhttps://lore.kernel.org/linux-cve-announce/2025022659-CVE-2022-49450-a2f7@gregkh/T"], "threat_severity": "Moderate"}