CVE-2022-49775: Vulnerability in Linux Linux

Severity: highType: vulnerabilityCVE-2022-49775

In the Linux kernel, the following vulnerability has been resolved: tcp: cdg: allow tcp_cdg_release() to be called multiple times Apparently, mptcp is able to call tcp_disconnect() on an already disconnected flow. This is generally fine, unless current congestion control is CDG, because it might trigger a double-free [1] Instead of fixing MPTCP, and future bugs, we can make tcp_disconnect() more resilient. [1] BUG: KASAN: double-free in slab_free mm/slub.c:3539 [inline] BUG: KASAN: double-free in kfree+0xe2/0x580 mm/slub.c:4567 CPU: 0 PID: 3645 Comm: kworker/0:7 Not tainted 6.0.0-syzkaller-02734-g0326074ff465 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 Workqueue: events mptcp_worker Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:317 [inline] print_report.cold+0x2ba/0x719 mm/kasan/report.c:433 kasan_report_invalid_free+0x81/0x190 mm/kasan/report.c:462 ____kasan_slab_free+0x18b/0x1c0 mm/kasan/common.c:356 kasan_slab_free include/linux/kasan.h:200 [inline] slab_free_hook mm/slub.c:1759 [inline] slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1785 slab_free mm/slub.c:3539 [inline] kfree+0xe2/0x580 mm/slub.c:4567 tcp_disconnect+0x980/0x1e20 net/ipv4/tcp.c:3145 __mptcp_close_ssk+0x5ca/0x7e0 net/mptcp/protocol.c:2327 mptcp_do_fastclose net/mptcp/protocol.c:2592 [inline] mptcp_worker+0x78c/0xff0 net/mptcp/protocol.c:2627 process_one_work+0x991/0x1610 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e4/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306 </TASK> Allocated by task 3671: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:437 [inline] ____kasan_kmalloc mm/kasan/common.c:516 [inline] ____kasan_kmalloc mm/kasan/common.c:475 [inline] __kasan_kmalloc+0xa9/0xd0 mm/kasan/common.c:525 kmalloc_array include/linux/slab.h:640 [inline] kcalloc include/linux/slab.h:671 [inline] tcp_cdg_init+0x10d/0x170 net/ipv4/tcp_cdg.c:380 tcp_init_congestion_control+0xab/0x550 net/ipv4/tcp_cong.c:193 tcp_reinit_congestion_control net/ipv4/tcp_cong.c:217 [inline] tcp_set_congestion_control+0x96c/0xaa0 net/ipv4/tcp_cong.c:391 do_tcp_setsockopt+0x505/0x2320 net/ipv4/tcp.c:3513 tcp_setsockopt+0xd4/0x100 net/ipv4/tcp.c:3801 mptcp_setsockopt+0x35f/0x2570 net/mptcp/sockopt.c:844 __sys_setsockopt+0x2d6/0x690 net/socket.c:2252 __do_sys_setsockopt net/socket.c:2263 [inline] __se_sys_setsockopt net/socket.c:2260 [inline] __x64_sys_setsockopt+0xba/0x150 net/socket.c:2260 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Freed by task 16: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track+0x21/0x30 mm/kasan/common.c:45 kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370 ____kasan_slab_free mm/kasan/common.c:367 [inline] ____kasan_slab_free+0x166/0x1c0 mm/kasan/common.c:329 kasan_slab_free include/linux/kasan.h:200 [inline] slab_free_hook mm/slub.c:1759 [inline] slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1785 slab_free mm/slub.c:3539 [inline] kfree+0xe2/0x580 mm/slub.c:4567 tcp_cleanup_congestion_control+0x70/0x120 net/ipv4/tcp_cong.c:226 tcp_v4_destroy_sock+0xdd/0x750 net/ipv4/tcp_ipv4.c:2254 tcp_v6_destroy_sock+0x11/0x20 net/ipv6/tcp_ipv6.c:1969 inet_csk_destroy_sock+0x196/0x440 net/ipv4/inet_connection_sock.c:1157 tcp_done+0x23b/0x340 net/ipv4/tcp.c:4649 tcp_rcv_state_process+0x40e7/0x4990 net/ipv4/tcp_input.c:6624 tcp_v6_do_rcv+0x3fc/0x13c0 net/ipv6/tcp_ipv6.c:1525 tcp_v6_rcv+0x2e8e/0x3830 net/ipv6/tcp_ipv6.c:1759 ip6_protocol_deliver_rcu+0x2db/0x1950 net/ipv6/ip6_input.c:439 ip6_input_finish+0x14c/0x2c0 net/ipv6/ip6_input.c:484 NF_HOOK include/linux/netfilter.h:302 [inline] NF_HOOK include/linux/netfilter.h:296 [inline] ip6_input+0x9c/0xd ---truncated---

AI Analysis

Technical Summary

CVE-2022-49775 is a vulnerability in the Linux kernel's TCP congestion control mechanism, specifically related to the CDG (Credit-Based Delay Gradient) congestion control algorithm and its interaction with Multipath TCP (MPTCP). The issue arises because MPTCP can invoke tcp_disconnect() on an already disconnected TCP flow. While this is generally safe, when the congestion control algorithm in use is CDG, this sequence can trigger a double-free memory error. The double-free occurs because tcp_cdg_release() is called multiple times on the same resource, leading to a use-after-free or double-free condition in kernel memory management. This vulnerability was identified through Kernel Address Sanitizer (KASAN) reports showing double-free bugs in slab allocator functions during tcp_disconnect() operations. The root cause is that tcp_disconnect() was not resilient enough to handle multiple calls safely when CDG congestion control is active. The fix involves hardening tcp_disconnect() to safely handle repeated calls, rather than modifying MPTCP behavior. This vulnerability affects Linux kernel versions prior to the patch and is relevant to systems using MPTCP with CDG congestion control. Although no known exploits are reported in the wild, the vulnerability could potentially be triggered by local or remote attackers who can manipulate MPTCP flows and congestion control settings. Exploitation could lead to kernel memory corruption, causing system crashes (denial of service) or potentially enabling privilege escalation or arbitrary code execution in the kernel context.

Potential Impact

For European organizations, the impact of this vulnerability can be significant, especially for those relying on Linux-based infrastructure that utilizes MPTCP and CDG congestion control. MPTCP is increasingly used in data centers, cloud environments, and telecom networks to improve connection reliability and throughput by leveraging multiple network paths. A successful exploitation could lead to kernel crashes, resulting in denial of service for critical services, or worse, allow attackers to execute arbitrary code with kernel privileges, compromising confidentiality, integrity, and availability of systems. This is particularly critical for sectors such as finance, healthcare, telecommunications, and government agencies in Europe that depend heavily on Linux servers and cloud services. The vulnerability could disrupt business operations, cause data breaches, or enable lateral movement within networks. Given the kernel-level nature of the flaw, remediation is essential to maintain system stability and security.

Mitigation Recommendations

1. Immediate patching: Apply the latest Linux kernel updates that include the fix for CVE-2022-49775. Monitor vendor advisories and incorporate patches into all affected systems promptly. 2. Disable CDG congestion control if not required: Since the vulnerability is specific to the CDG congestion control algorithm, disabling CDG on systems where it is not essential can reduce risk. 3. Limit MPTCP usage: Evaluate the necessity of MPTCP in your environment. If not required, consider disabling MPTCP to reduce the attack surface. 4. Harden kernel security: Employ kernel hardening techniques such as Kernel Address Sanitizer (KASAN) in testing environments to detect similar issues early. 5. Network segmentation and access control: Restrict access to systems running vulnerable kernels, especially those exposed to untrusted networks, to limit exploitation opportunities. 6. Monitor system logs and kernel crash reports for signs of exploitation attempts or instability related to tcp_disconnect or congestion control. 7. Engage with Linux distribution maintainers and security teams to ensure timely updates and coordinated vulnerability management.