bpf, sockmap: Fix double uncharge the mem of sk_msg 漏洞信息(CVE-2022-49205)

一、漏洞 CVE-2022-49205 基础信息

AIGC 神龙大模型
美国国家漏洞数据库 NVD

漏洞标题

bpf, sockmap: 修复 sk_msg 内存的双重释放问题

来源：AIGC 神龙大模型

漏洞描述信息

N/A

来源：AIGC 神龙大模型

CVSS信息

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

来源：AIGC 神龙大模型

漏洞类别

双重释放

来源：AIGC 神龙大模型

漏洞标题

bpf, sockmap: Fix double uncharge the mem of sk_msg

来源：美国国家漏洞数据库 NVD

漏洞描述信息

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix double uncharge the mem of sk_msg If tcp_bpf_sendmsg is running during a tear down operation, psock may be freed. tcp_bpf_sendmsg() tcp_bpf_send_verdict() sk_msg_return() tcp_bpf_sendmsg_redir() unlikely(!psock)) sk_msg_free() The mem of msg has been uncharged in tcp_bpf_send_verdict() by sk_msg_return(), and would be uncharged by sk_msg_free() again. When psock is null, we can simply returning an error code, this would then trigger the sk_msg_free_nocharge in the error path of __SK_REDIRECT and would have the side effect of throwing an error up to user space. This would be a slight change in behavior from user side but would look the same as an error if the redirect on the socket threw an error. This issue can cause the following info: WARNING: CPU: 0 PID: 2136 at net/ipv4/af_inet.c:155 inet_sock_destruct+0x13c/0x260 Call Trace: <TASK> __sk_destruct+0x24/0x1f0 sk_psock_destroy+0x19b/0x1c0 process_one_work+0x1b3/0x3c0 worker_thread+0x30/0x350 ? process_one_work+0x3c0/0x3c0 kthread+0xe6/0x110 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x22/0x30 </TASK>

来源：美国国家漏洞数据库 NVD

CVSS信息

N/A

来源：美国国家漏洞数据库 NVD

漏洞类别

N/A

来源：美国国家漏洞数据库 NVD

二、漏洞 CVE-2022-49205 的公开POC

#	POC 描述	源链接	神龙链接

三、漏洞 CVE-2022-49205 的情报信息

标题： bpf, sockmap: Fix double uncharge the mem of sk_msg - kernel/git/stable/linux.git - Linux kernel stable tree -- 🔗来源链接

标签：
标题： bpf, sockmap: Fix double uncharge the mem of sk_msg - kernel/git/stable/linux.git - Linux kernel stable tree -- 🔗来源链接

标签：
标题： bpf, sockmap: Fix double uncharge the mem of sk_msg - kernel/git/stable/linux.git - Linux kernel stable tree -- 🔗来源链接

标签：
标题： bpf, sockmap: Fix double uncharge the mem of sk_msg - kernel/git/stable/linux.git - Linux kernel stable tree -- 🔗来源链接

标签：
标题： bpf, sockmap: Fix double uncharge the mem of sk_msg - kernel/git/stable/linux.git - Linux kernel stable tree -- 🔗来源链接

标签：
标题： bpf, sockmap: Fix double uncharge the mem of sk_msg - kernel/git/stable/linux.git - Linux kernel stable tree -- 🔗来源链接

标签：
https://nvd.nist.gov/vuln/detail/CVE-2022-49205