CVE-2022-49094 is a vulnerability identified in the Linux kernel's TLS (Transport Layer Security) implementation, specifically within the net/tls subsystem. The flaw arises from an incorrect handling of memory size during the decryption process in the decrypt_internal function. The vulnerability is due to a mismatch between the allocated memory size for the initialization vector (IV) in the tls_ctx->rx.iv buffer and the size expected by the crypto_aead_ivsize() function for AES128-CCM encryption. Specifically, tls_set_sw_offload() allocates 12 bytes for the IV, but crypto_aead_ivsize() returns 16 bytes for the CCM mode of AES, leading to a memcpy operation that copies 16 bytes into a 12-byte buffer. This results in a slab-out-of-bounds memory read, which is detected by Kernel Address Sanitizer (KASAN) as a memory safety violation. The root cause is the use of crypto_aead_ivsize() instead of the correct calculation using prot->iv_size plus prot->salt_size when copying the IV in TLS 1.3 scenarios. This bug can cause kernel memory corruption, potentially leading to system instability, crashes (kernel panic), or exploitable conditions for privilege escalation or denial of service. The vulnerability affects Linux kernel versions identified by the commit hash f295b3ae9f5927e084bd5decdff82390e3471801 and similar builds. No known exploits are currently reported in the wild, and no CVSS score has been assigned yet. The fix involves correcting the IV size calculation to prevent out-of-bounds memory access during the memcpy operation.

For European organizations, this vulnerability poses a significant risk primarily to systems running vulnerable Linux kernel versions with TLS software offloading enabled. Since Linux is widely used in servers, cloud infrastructure, and embedded devices across Europe, exploitation could lead to kernel crashes, resulting in service outages and potential denial of service. More critically, if attackers can leverage this out-of-bounds read to execute arbitrary code or escalate privileges, it could compromise the confidentiality and integrity of sensitive data and systems. This is particularly concerning for sectors with high reliance on Linux-based infrastructure such as finance, telecommunications, government, and critical infrastructure. The absence of known exploits reduces immediate risk, but the vulnerability's nature suggests that skilled attackers could develop exploits, especially in environments where TLS offloading is common. The impact on availability and potential for privilege escalation makes this a threat that European organizations must address promptly to maintain operational continuity and security compliance.

European organizations should take the following specific steps to mitigate this vulnerability: 1) Identify and inventory all Linux systems running kernel versions affected by this vulnerability, focusing on those using TLS software offloading features. 2) Apply the official Linux kernel patches or updates that correct the IV size calculation in the net/tls subsystem as soon as they are available from trusted Linux distribution vendors or kernel maintainers. 3) If immediate patching is not feasible, consider disabling TLS software offloading temporarily to prevent triggering the vulnerable code path. 4) Monitor kernel logs and use tools like KASAN or other memory safety checkers in testing environments to detect any anomalous behavior related to TLS decryption. 5) Implement strict access controls and network segmentation to limit exposure of vulnerable systems to untrusted networks or users. 6) Maintain up-to-date backups and incident response plans to quickly recover from potential exploitation or system crashes. 7) Engage with Linux distribution security advisories and subscribe to vulnerability feeds to stay informed about updates or emerging exploits related to this CVE.