CVE-2022-49325 (GCVE-0-2022-49325)
Vulnerability from cvelistv5
Published
2025-02-26 02:10
Modified
2025-05-04 08:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
tcp: add accessors to read/set tp->snd_cwnd
We had various bugs over the years with code
breaking the assumption that tp->snd_cwnd is greater
than zero.
Lately, syzbot reported the WARN_ON_ONCE(!tp->prior_cwnd) added
in commit 8b8a321ff72c ("tcp: fix zero cwnd in tcp_cwnd_reduction")
can trigger, and without a repro we would have to spend
considerable time finding the bug.
Instead of complaining too late, we want to catch where
and when tp->snd_cwnd is set to an illegal value.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/tcp.h",
"include/trace/events/tcp.h",
"net/core/filter.c",
"net/ipv4/tcp.c",
"net/ipv4/tcp_bbr.c",
"net/ipv4/tcp_bic.c",
"net/ipv4/tcp_cdg.c",
"net/ipv4/tcp_cong.c",
"net/ipv4/tcp_cubic.c",
"net/ipv4/tcp_dctcp.c",
"net/ipv4/tcp_highspeed.c",
"net/ipv4/tcp_htcp.c",
"net/ipv4/tcp_hybla.c",
"net/ipv4/tcp_illinois.c",
"net/ipv4/tcp_input.c",
"net/ipv4/tcp_ipv4.c",
"net/ipv4/tcp_lp.c",
"net/ipv4/tcp_metrics.c",
"net/ipv4/tcp_nv.c",
"net/ipv4/tcp_output.c",
"net/ipv4/tcp_rate.c",
"net/ipv4/tcp_scalable.c",
"net/ipv4/tcp_vegas.c",
"net/ipv4/tcp_veno.c",
"net/ipv4/tcp_westwood.c",
"net/ipv4/tcp_yeah.c",
"net/ipv6/tcp_ipv6.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3308676ec525901bf1656014003c443a60730a04",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "5aba0ad44fb4a7fb78c5076c313456de199a3c29",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "41e191fe72282e193a7744e2fc1786b23156c9e4",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "40570375356c874b1578e05c1dcc3ff7c1322dbe",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/tcp.h",
"include/trace/events/tcp.h",
"net/core/filter.c",
"net/ipv4/tcp.c",
"net/ipv4/tcp_bbr.c",
"net/ipv4/tcp_bic.c",
"net/ipv4/tcp_cdg.c",
"net/ipv4/tcp_cong.c",
"net/ipv4/tcp_cubic.c",
"net/ipv4/tcp_dctcp.c",
"net/ipv4/tcp_highspeed.c",
"net/ipv4/tcp_htcp.c",
"net/ipv4/tcp_hybla.c",
"net/ipv4/tcp_illinois.c",
"net/ipv4/tcp_input.c",
"net/ipv4/tcp_ipv4.c",
"net/ipv4/tcp_lp.c",
"net/ipv4/tcp_metrics.c",
"net/ipv4/tcp_nv.c",
"net/ipv4/tcp_output.c",
"net/ipv4/tcp_rate.c",
"net/ipv4/tcp_scalable.c",
"net/ipv4/tcp_vegas.c",
"net/ipv4/tcp_veno.c",
"net/ipv4/tcp_westwood.c",
"net/ipv4/tcp_yeah.c",
"net/ipv6/tcp_ipv6.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.47",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.17.*",
"status": "unaffected",
"version": "5.17.15",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.18.*",
"status": "unaffected",
"version": "5.18.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "5.19",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.47",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.17.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.18.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: add accessors to read/set tp-\u003esnd_cwnd\n\nWe had various bugs over the years with code\nbreaking the assumption that tp-\u003esnd_cwnd is greater\nthan zero.\n\nLately, syzbot reported the WARN_ON_ONCE(!tp-\u003eprior_cwnd) added\nin commit 8b8a321ff72c (\"tcp: fix zero cwnd in tcp_cwnd_reduction\")\ncan trigger, and without a repro we would have to spend\nconsiderable time finding the bug.\n\nInstead of complaining too late, we want to catch where\nand when tp-\u003esnd_cwnd is set to an illegal value."
}
],
"providerMetadata": {
"dateUpdated": "2025-05-04T08:35:14.345Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3308676ec525901bf1656014003c443a60730a04"
},
{
"url": "https://git.kernel.org/stable/c/5aba0ad44fb4a7fb78c5076c313456de199a3c29"
},
{
"url": "https://git.kernel.org/stable/c/41e191fe72282e193a7744e2fc1786b23156c9e4"
},
{
"url": "https://git.kernel.org/stable/c/40570375356c874b1578e05c1dcc3ff7c1322dbe"
}
],
"title": "tcp: add accessors to read/set tp-\u003esnd_cwnd",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2022-49325",
"datePublished": "2025-02-26T02:10:48.158Z",
"dateReserved": "2025-02-26T02:08:31.538Z",
"dateUpdated": "2025-05-04T08:35:14.345Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}