CVE-2022-48819

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-48819
In the Linux kernel, the following vulnerability has been resolved: tcp: take care of mixed splice()/sendmsg(MSG_ZEROCOPY) case syzbot found that mixing sendpage() and sendmsg(MSG_ZEROCOPY) calls over the same TCP socket would again trigger the infamous warning in inet_sock_destruct() WARN_ON(sk_forward_alloc_get(sk)); While Talal took into account a mix of regular copied data and MSG_ZEROCOPY one in the same skb, the sendpage() path has been forgotten. We want the charging to happen for sendpage(), because pages could be coming from a pipe. What is missing is the downgrading of pure zerocopy status to make sure sk_forward_alloc will stay synced. Add tcp_downgrade_zcopy_pure() helper so that we can use it from the two callers.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/47f3860c4931175f112f28dcac66eacca9b1040f Patch
https://git.kernel.org/stable/c/f8d9d938514f46c4892aff6bfe32f425e84d81cc Patch
https://git.kernel.org/stable/c/47f3860c4931175f112f28dcac66eacca9b1040f Patch
https://git.kernel.org/stable/c/f8d9d938514f46c4892aff6bfe32f425e84d81cc Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.17:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.17:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.17:rc3:*:*:*:*:*:*
History

07 Oct 2025, 19:53

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE NVD-CWE-noinfo
First Time Linux linux Kernel
Linux
References () https://git.kernel.org/stable/c/47f3860c4931175f112f28dcac66eacca9b1040f - () https://git.kernel.org/stable/c/47f3860c4931175f112f28dcac66eacca9b1040f - Patch
References () https://git.kernel.org/stable/c/f8d9d938514f46c4892aff6bfe32f425e84d81cc - () https://git.kernel.org/stable/c/f8d9d938514f46c4892aff6bfe32f425e84d81cc - Patch
CPE cpe:2.3:o:linux:linux_kernel:5.17:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.17:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.17:rc2:*:*:*:*:*:*

21 Nov 2024, 07:34

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/47f3860c4931175f112f28dcac66eacca9b1040f - () https://git.kernel.org/stable/c/47f3860c4931175f112f28dcac66eacca9b1040f -
References () https://git.kernel.org/stable/c/f8d9d938514f46c4892aff6bfe32f425e84d81cc - () https://git.kernel.org/stable/c/f8d9d938514f46c4892aff6bfe32f425e84d81cc -
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: tcp: cuidado del caso mixto splice()/sendmsg(MSG_ZEROCOPY) syzbot descubrió que mezclar llamadas sendpage() y sendmsg(MSG_ZEROCOPY) en el mismo socket TCP desencadenaría nuevamente el infame advertencia en inet_sock_destruct() WARN_ON(sk_forward_alloc_get(sk)); Si bien Talal tuvo en cuenta una combinación de datos copiados normales y uno MSG_ZEROCOPY en el mismo skb, la ruta sendpage() se olvidó. Queremos que el cobro se realice por sendpage(), porque las páginas podrían provenir de una tubería. Lo que falta es degradar el estado de copia cero pura para garantizar que sk_forward_alloc permanezca sincronizado. Agregue el asistente tcp_downgrade_zcopy_pure() para que podamos usarlo desde las dos personas que llaman.

16 Jul 2024, 12:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-07-16 12:15

Updated : 2025-10-07 19:53

NVD link : CVE-2022-48819

Mitre link : CVE-2022-48819

CVE.ORG link : CVE-2022-48819

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-noinfo