« Volver al listado

CVE-2022-49697

Estado: AnalizadaMedia (5.5)—

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix request_sock leak in sk lookup helpers

A customer reported a request_socket leak in a Calico cloud environment. We found that a BPF program was doing a socket lookup with takes a refcnt on the socket and that it was finding the request_socket but returning the parent LISTEN socket via sk_to_full_sk() without decrementing the child request socket 1st, resulting in request_sock slab object leak. This patch retains the existing behaviour of returning full socks to the caller but it also decrements the child request_socket if one is present before doing so to prevent the leak.

Leer descripción completaMostrar menos

Thanks to Curtis Taylor for all the help in diagnosing and testing this. And thanks to Antoine Tenart for the reproducer and patch input.

v2 of this patch contains, refactor as per Daniel Borkmann's suggestions to validate RCU flags on the listen socket so that it balances with bpf_sk_release() and update comments as per Martin KaFai Lau's suggestion. One small change to Daniels suggestion, put "sk = sk2" under "if (sk2 != sk)" to avoid an extra instruction.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Linux — Linux Kernel

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-49697",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "edbf8c01de5a104a71ed6df2bf6421ceb2836a8e",
              "lessThan": "8ffe2e50e9678c8373027492035f094b130437f1",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "edbf8c01de5a104a71ed6df2bf6421ceb2836a8e",
              "lessThan": "516760f1d2979903eaad5b437256913c5cd98416",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "edbf8c01de5a104a71ed6df2bf6421ceb2836a8e",
              "lessThan": "b03607437ea81b850599f705096b05b85e7a4a71",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "edbf8c01de5a104a71ed6df2bf6421ceb2836a8e",
              "lessThan": "5a62b5ba4c0ce8315b6382cd4ace81b48cd121cd",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "edbf8c01de5a104a71ed6df2bf6421ceb2836a8e",
              "lessThan": "3046a827316c0e55fc563b4fb78c93b9ca5c7c37",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "net/core/filter.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.2"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.2",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.4.202",
              "versionType": "semver",
              "lessThanOrEqual": "5.4.*"
            },
            {
              "status": "unaffected",
              "version": "5.10.127",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.51",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "5.18.8",
              "versionType": "semver",
              "lessThanOrEqual": "5.18.*"
            },
            {
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "net/core/filter.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-02-26T07:01:44.450",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/3046a827316c0e55fc563b4fb78c93b9ca5c7c37",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/516760f1d2979903eaad5b437256913c5cd98416",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/5a62b5ba4c0ce8315b6382cd4ace81b48cd121cd",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/8ffe2e50e9678c8373027492035f094b130437f1",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b03607437ea81b850599f705096b05b85e7a4a71",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-401"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix request_sock leak in sk lookup helpers\n\nA customer reported a request_socket leak in a Calico cloud environment. We\nfound that a BPF program was doing a socket lookup with takes a refcnt on\nthe socket and that it was finding the request_socket but returning the parent\nLISTEN socket via sk_to_full_sk() without decrementing the child request socket\n1st, resulting in request_sock slab object leak. This patch retains the\nexisting behaviour of returning full socks to the caller but it also decrements\nthe child request_socket if one is present before doing so to prevent the leak.\n\nThanks to Curtis Taylor for all the help in diagnosing and testing this. And\nthanks to Antoine Tenart for the reproducer and patch input.\n\nv2 of this patch contains, refactor as per Daniel Borkmann's suggestions to\nvalidate RCU flags on the listen socket so that it balances with bpf_sk_release()\nand update comments as per Martin KaFai Lau's suggestion. One small change to\nDaniels suggestion, put \"sk = sk2\" under \"if (sk2 != sk)\" to avoid an extra\ninstruction."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: Corregir fuga de request_sock en ayudantes de búsqueda de sk Un cliente informó de una fuga de request_socket en un entorno de nube de Calico. Descubrimos que un programa BPF estaba realizando una búsqueda de socket con toma un refcnt en el socket y que estaba encontrando el request_socket pero devolviendo el socket LISTEN principal a través de sk_to_full_sk() sin decrementar primero el socket de solicitud secundario, lo que resultaba en una fuga de objeto slab request_sock. Este parche conserva el comportamiento existente de devolver calcetines completos al llamador, pero también decrementa el request_socket secundario si hay uno presente antes de hacerlo para evitar la fuga. Gracias a Curtis Taylor por toda la ayuda para diagnosticar y probar esto. Y gracias a Antoine Tenart por el reproductor y la entrada del parche. La versión 2 de este parche contiene una refactorización según las sugerencias de Daniel Borkmann para validar los indicadores de RCU en el socket de escucha de modo que se equilibre con bpf_sk_release() y actualizar los comentarios según la sugerencia de Martin KaFai Lau. Un pequeño cambio a la sugerencia de Daniel: poner \"sk = sk2\" debajo de \"if (sk2 != sk)\" para evitar una instrucción adicional."
    }
  ],
  "lastModified": "2026-06-17T05:18:53.663",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C4BD43DC-74E7-4708-AE23-CB629D8443B0",
              "versionEndExcluding": "5.4.202",
              "versionStartIncluding": "5.2"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "758A1E17-EBCF-401B-83C7-B682D38D61BE",
              "versionEndExcluding": "5.10.127",
              "versionStartIncluding": "5.5"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B43F7696-8D52-482D-9080-84279B0CB38C",
              "versionEndExcluding": "5.15.51",
              "versionStartIncluding": "5.11"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0172D3FA-DDEB-482A-A270-4A1495A8798C",
              "versionEndExcluding": "5.18.8",
              "versionStartIncluding": "5.16"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:5.19:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A8C30C2D-F82D-4D37-AB48-D76ABFBD5377"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:5.19:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BF8547FC-C849-4F1B-804B-A93AE2F04A92"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:5.19:rc3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F3068028-F453-4A1C-B80F-3F5609ACEF60"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}