CVE-2022-50555 (GCVE-0-2022-50555)
Vulnerability from cvelistv5
Published
2025-10-07 15:21
Modified
2025-10-07 15:21
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
tipc: fix a null-ptr-deref in tipc_topsrv_accept
syzbot found a crash in tipc_topsrv_accept:
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
Workqueue: tipc_rcv tipc_topsrv_accept
RIP: 0010:kernel_accept+0x22d/0x350 net/socket.c:3487
Call Trace:
<TASK>
tipc_topsrv_accept+0x197/0x280 net/tipc/topsrv.c:460
process_one_work+0x991/0x1610 kernel/workqueue.c:2289
worker_thread+0x665/0x1080 kernel/workqueue.c:2436
kthread+0x2e4/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
It was caused by srv->listener that might be set to null by
tipc_topsrv_stop() in net .exit whereas it's still used in
tipc_topsrv_accept() worker.
srv->listener is protected by srv->idr_lock in tipc_topsrv_stop(), so add
a check for srv->listener under srv->idr_lock in tipc_topsrv_accept() to
avoid the null-ptr-deref. To ensure the lsock is not released during the
tipc_topsrv_accept(), move sock_release() after tipc_topsrv_work_stop()
where it's waiting until the tipc_topsrv_accept worker to be done.
Note that sk_callback_lock is used to protect sk->sk_user_data instead of
srv->listener, and it should check srv in tipc_topsrv_listener_data_ready()
instead. This also ensures that no more tipc_topsrv_accept worker will be
started after tipc_conn_close() is called in tipc_topsrv_stop() where it
sets sk->sk_user_data to null.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| ▼ | Linux | Linux |
Version: 0ef897be12b8b4cf297b6016e79ec97ec90f2cf6 Version: 0ef897be12b8b4cf297b6016e79ec97ec90f2cf6 Version: 0ef897be12b8b4cf297b6016e79ec97ec90f2cf6 Version: 0ef897be12b8b4cf297b6016e79ec97ec90f2cf6 Version: 0ef897be12b8b4cf297b6016e79ec97ec90f2cf6 Version: 0ef897be12b8b4cf297b6016e79ec97ec90f2cf6 |
||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/tipc/topsrv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ce69bdac2310152bb70845024d5d704c52aabfc3",
"status": "affected",
"version": "0ef897be12b8b4cf297b6016e79ec97ec90f2cf6",
"versionType": "git"
},
{
"lessThan": "24b129aed8730e48f47d852d58d76825ab6f407c",
"status": "affected",
"version": "0ef897be12b8b4cf297b6016e79ec97ec90f2cf6",
"versionType": "git"
},
{
"lessThan": "32a3d4660b34ce49ac0162338ebe362098e2f5df",
"status": "affected",
"version": "0ef897be12b8b4cf297b6016e79ec97ec90f2cf6",
"versionType": "git"
},
{
"lessThan": "7a939503fc32bff4ed60800b73ff7fbb4aea2142",
"status": "affected",
"version": "0ef897be12b8b4cf297b6016e79ec97ec90f2cf6",
"versionType": "git"
},
{
"lessThan": "cedb41664e27b2cae7e21487f1bee22dcd84037d",
"status": "affected",
"version": "0ef897be12b8b4cf297b6016e79ec97ec90f2cf6",
"versionType": "git"
},
{
"lessThan": "82cb4e4612c633a9ce320e1773114875604a3cce",
"status": "affected",
"version": "0ef897be12b8b4cf297b6016e79ec97ec90f2cf6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/tipc/topsrv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.17"
},
{
"lessThan": "4.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.264",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.223",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.0.*",
"status": "unaffected",
"version": "6.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.264",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.223",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.153",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.77",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.7",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1",
"versionStartIncluding": "4.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: fix a null-ptr-deref in tipc_topsrv_accept\n\nsyzbot found a crash in tipc_topsrv_accept:\n\n KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\n Workqueue: tipc_rcv tipc_topsrv_accept\n RIP: 0010:kernel_accept+0x22d/0x350 net/socket.c:3487\n Call Trace:\n \u003cTASK\u003e\n tipc_topsrv_accept+0x197/0x280 net/tipc/topsrv.c:460\n process_one_work+0x991/0x1610 kernel/workqueue.c:2289\n worker_thread+0x665/0x1080 kernel/workqueue.c:2436\n kthread+0x2e4/0x3a0 kernel/kthread.c:376\n ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306\n\nIt was caused by srv-\u003elistener that might be set to null by\ntipc_topsrv_stop() in net .exit whereas it\u0027s still used in\ntipc_topsrv_accept() worker.\n\nsrv-\u003elistener is protected by srv-\u003eidr_lock in tipc_topsrv_stop(), so add\na check for srv-\u003elistener under srv-\u003eidr_lock in tipc_topsrv_accept() to\navoid the null-ptr-deref. To ensure the lsock is not released during the\ntipc_topsrv_accept(), move sock_release() after tipc_topsrv_work_stop()\nwhere it\u0027s waiting until the tipc_topsrv_accept worker to be done.\n\nNote that sk_callback_lock is used to protect sk-\u003esk_user_data instead of\nsrv-\u003elistener, and it should check srv in tipc_topsrv_listener_data_ready()\ninstead. This also ensures that no more tipc_topsrv_accept worker will be\nstarted after tipc_conn_close() is called in tipc_topsrv_stop() where it\nsets sk-\u003esk_user_data to null."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-07T15:21:16.179Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ce69bdac2310152bb70845024d5d704c52aabfc3"
},
{
"url": "https://git.kernel.org/stable/c/24b129aed8730e48f47d852d58d76825ab6f407c"
},
{
"url": "https://git.kernel.org/stable/c/32a3d4660b34ce49ac0162338ebe362098e2f5df"
},
{
"url": "https://git.kernel.org/stable/c/7a939503fc32bff4ed60800b73ff7fbb4aea2142"
},
{
"url": "https://git.kernel.org/stable/c/cedb41664e27b2cae7e21487f1bee22dcd84037d"
},
{
"url": "https://git.kernel.org/stable/c/82cb4e4612c633a9ce320e1773114875604a3cce"
}
],
"title": "tipc: fix a null-ptr-deref in tipc_topsrv_accept",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2022-50555",
"datePublished": "2025-10-07T15:21:16.179Z",
"dateReserved": "2025-10-07T15:15:38.669Z",
"dateUpdated": "2025-10-07T15:21:16.179Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2022-50555\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-10-07T16:15:43.850\",\"lastModified\":\"2025-10-08T19:38:32.610\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntipc: fix a null-ptr-deref in tipc_topsrv_accept\\n\\nsyzbot found a crash in tipc_topsrv_accept:\\n\\n KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\\n Workqueue: tipc_rcv tipc_topsrv_accept\\n RIP: 0010:kernel_accept+0x22d/0x350 net/socket.c:3487\\n Call Trace:\\n \u003cTASK\u003e\\n tipc_topsrv_accept+0x197/0x280 net/tipc/topsrv.c:460\\n process_one_work+0x991/0x1610 kernel/workqueue.c:2289\\n worker_thread+0x665/0x1080 kernel/workqueue.c:2436\\n kthread+0x2e4/0x3a0 kernel/kthread.c:376\\n ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306\\n\\nIt was caused by srv-\u003elistener that might be set to null by\\ntipc_topsrv_stop() in net .exit whereas it\u0027s still used in\\ntipc_topsrv_accept() worker.\\n\\nsrv-\u003elistener is protected by srv-\u003eidr_lock in tipc_topsrv_stop(), so add\\na check for srv-\u003elistener under srv-\u003eidr_lock in tipc_topsrv_accept() to\\navoid the null-ptr-deref. To ensure the lsock is not released during the\\ntipc_topsrv_accept(), move sock_release() after tipc_topsrv_work_stop()\\nwhere it\u0027s waiting until the tipc_topsrv_accept worker to be done.\\n\\nNote that sk_callback_lock is used to protect sk-\u003esk_user_data instead of\\nsrv-\u003elistener, and it should check srv in tipc_topsrv_listener_data_ready()\\ninstead. This also ensures that no more tipc_topsrv_accept worker will be\\nstarted after tipc_conn_close() is called in tipc_topsrv_stop() where it\\nsets sk-\u003esk_user_data to null.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/24b129aed8730e48f47d852d58d76825ab6f407c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/32a3d4660b34ce49ac0162338ebe362098e2f5df\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7a939503fc32bff4ed60800b73ff7fbb4aea2142\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/82cb4e4612c633a9ce320e1773114875604a3cce\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ce69bdac2310152bb70845024d5d704c52aabfc3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cedb41664e27b2cae7e21487f1bee22dcd84037d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
}
}