fkie_cve-2022-50409
Vulnerability from fkie_nvd
Published
2025-09-18 16:15
Modified
2025-09-19 16:00
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory Fixes the below NULL pointer dereference: [...] [ 14.471200] Call Trace: [ 14.471562] <TASK> [ 14.471882] lock_acquire+0x245/0x2e0 [ 14.472416] ? remove_wait_queue+0x12/0x50 [ 14.473014] ? _raw_spin_lock_irqsave+0x17/0x50 [ 14.473681] _raw_spin_lock_irqsave+0x3d/0x50 [ 14.474318] ? remove_wait_queue+0x12/0x50 [ 14.474907] remove_wait_queue+0x12/0x50 [ 14.475480] sk_stream_wait_memory+0x20d/0x340 [ 14.476127] ? do_wait_intr_irq+0x80/0x80 [ 14.476704] do_tcp_sendpages+0x287/0x600 [ 14.477283] tcp_bpf_push+0xab/0x260 [ 14.477817] tcp_bpf_sendmsg_redir+0x297/0x500 [ 14.478461] ? __local_bh_enable_ip+0x77/0xe0 [ 14.479096] tcp_bpf_send_verdict+0x105/0x470 [ 14.479729] tcp_bpf_sendmsg+0x318/0x4f0 [ 14.480311] sock_sendmsg+0x2d/0x40 [ 14.480822] ____sys_sendmsg+0x1b4/0x1c0 [ 14.481390] ? copy_msghdr_from_user+0x62/0x80 [ 14.482048] ___sys_sendmsg+0x78/0xb0 [ 14.482580] ? vmf_insert_pfn_prot+0x91/0x150 [ 14.483215] ? __do_fault+0x2a/0x1a0 [ 14.483738] ? do_fault+0x15e/0x5d0 [ 14.484246] ? __handle_mm_fault+0x56b/0x1040 [ 14.484874] ? lock_is_held_type+0xdf/0x130 [ 14.485474] ? find_held_lock+0x2d/0x90 [ 14.486046] ? __sys_sendmsg+0x41/0x70 [ 14.486587] __sys_sendmsg+0x41/0x70 [ 14.487105] ? intel_pmu_drain_pebs_core+0x350/0x350 [ 14.487822] do_syscall_64+0x34/0x80 [ 14.488345] entry_SYSCALL_64_after_hwframe+0x63/0xcd [...] The test scenario has the following flow: thread1 thread2 ----------- --------------- tcp_bpf_sendmsg tcp_bpf_send_verdict tcp_bpf_sendmsg_redir sock_close tcp_bpf_push_locked __sock_release tcp_bpf_push //inet_release do_tcp_sendpages sock->ops->release sk_stream_wait_memory // tcp_close sk_wait_event sk->sk_prot->close release_sock(__sk); *** lock_sock(sk); __tcp_close sock_orphan(sk) sk->sk_wq = NULL release_sock **** lock_sock(__sk); remove_wait_queue(sk_sleep(sk), &wait); sk_sleep(sk) //NULL pointer dereference &rcu_dereference_raw(sk->sk_wq)->wait While waiting for memory in thread1, the socket is released with its wait queue because thread2 has closed it. This caused by tcp_bpf_send_verdict didn't increase the f_count of psock->sk_redir->sk_socket->file in thread1. We should check if SOCK_DEAD flag is set on wakeup in sk_stream_wait_memory before accessing the wait queue.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/124b7c773271f06af5a2cea694b283cdb5275cf5
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/1f48ab20b80f39c0d85119243109d02946fde6d5
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/35f5e70bdfa7432762ac4ffa75e5a7574ac5563e
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/3f8ef65af927db247418d4e1db49164d7a158fc5
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/435f5aa4421782af197b98d8525263977be4af5c
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/5fe03917bb017d9af68a95f989f1c122eebc69a6
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/65029aaedd15d9fe5ea1a899134e236d83f627bb
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a76462dbdd8bddcbeec9463bc9e54e509b860762
Impacted products
Vendor Product Version


To clipboard 

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: If sock is dead don\u0027t access sock\u0027s sk_wq in sk_stream_wait_memory\n\nFixes the below NULL pointer dereference:\n\n  [...]\n  [   14.471200] Call Trace:\n  [   14.471562]  \u003cTASK\u003e\n  [   14.471882]  lock_acquire+0x245/0x2e0\n  [   14.472416]  ? remove_wait_queue+0x12/0x50\n  [   14.473014]  ? _raw_spin_lock_irqsave+0x17/0x50\n  [   14.473681]  _raw_spin_lock_irqsave+0x3d/0x50\n  [   14.474318]  ? remove_wait_queue+0x12/0x50\n  [   14.474907]  remove_wait_queue+0x12/0x50\n  [   14.475480]  sk_stream_wait_memory+0x20d/0x340\n  [   14.476127]  ? do_wait_intr_irq+0x80/0x80\n  [   14.476704]  do_tcp_sendpages+0x287/0x600\n  [   14.477283]  tcp_bpf_push+0xab/0x260\n  [   14.477817]  tcp_bpf_sendmsg_redir+0x297/0x500\n  [   14.478461]  ? __local_bh_enable_ip+0x77/0xe0\n  [   14.479096]  tcp_bpf_send_verdict+0x105/0x470\n  [   14.479729]  tcp_bpf_sendmsg+0x318/0x4f0\n  [   14.480311]  sock_sendmsg+0x2d/0x40\n  [   14.480822]  ____sys_sendmsg+0x1b4/0x1c0\n  [   14.481390]  ? copy_msghdr_from_user+0x62/0x80\n  [   14.482048]  ___sys_sendmsg+0x78/0xb0\n  [   14.482580]  ? vmf_insert_pfn_prot+0x91/0x150\n  [   14.483215]  ? __do_fault+0x2a/0x1a0\n  [   14.483738]  ? do_fault+0x15e/0x5d0\n  [   14.484246]  ? __handle_mm_fault+0x56b/0x1040\n  [   14.484874]  ? lock_is_held_type+0xdf/0x130\n  [   14.485474]  ? find_held_lock+0x2d/0x90\n  [   14.486046]  ? __sys_sendmsg+0x41/0x70\n  [   14.486587]  __sys_sendmsg+0x41/0x70\n  [   14.487105]  ? intel_pmu_drain_pebs_core+0x350/0x350\n  [   14.487822]  do_syscall_64+0x34/0x80\n  [   14.488345]  entry_SYSCALL_64_after_hwframe+0x63/0xcd\n  [...]\n\nThe test scenario has the following flow:\n\nthread1                               thread2\n-----------                           ---------------\n tcp_bpf_sendmsg\n  tcp_bpf_send_verdict\n   tcp_bpf_sendmsg_redir              sock_close\n    tcp_bpf_push_locked                 __sock_release\n     tcp_bpf_push                         //inet_release\n      do_tcp_sendpages                    sock-\u003eops-\u003erelease\n       sk_stream_wait_memory          \t   // tcp_close\n          sk_wait_event                      sk-\u003esk_prot-\u003eclose\n           release_sock(__sk);\n            ***\n                                                lock_sock(sk);\n                                                  __tcp_close\n                                                    sock_orphan(sk)\n                                                      sk-\u003esk_wq  = NULL\n                                                release_sock\n            ****\n           lock_sock(__sk);\n          remove_wait_queue(sk_sleep(sk), \u0026wait);\n             sk_sleep(sk)\n             //NULL pointer dereference\n             \u0026rcu_dereference_raw(sk-\u003esk_wq)-\u003ewait\n\nWhile waiting for memory in thread1, the socket is released with its wait\nqueue because thread2 has closed it. This caused by tcp_bpf_send_verdict\ndidn\u0027t increase the f_count of psock-\u003esk_redir-\u003esk_socket-\u003efile in thread1.\n\nWe should check if SOCK_DEAD flag is set on wakeup in sk_stream_wait_memory\nbefore accessing the wait queue."
    }
  ],
  "id": "CVE-2022-50409",
  "lastModified": "2025-09-19T16:00:27.847",
  "metrics": {},
  "published": "2025-09-18T16:15:44.133",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/124b7c773271f06af5a2cea694b283cdb5275cf5"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/1f48ab20b80f39c0d85119243109d02946fde6d5"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/35f5e70bdfa7432762ac4ffa75e5a7574ac5563e"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/3f8ef65af927db247418d4e1db49164d7a158fc5"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/435f5aa4421782af197b98d8525263977be4af5c"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/5fe03917bb017d9af68a95f989f1c122eebc69a6"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/65029aaedd15d9fe5ea1a899134e236d83f627bb"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/a76462dbdd8bddcbeec9463bc9e54e509b860762"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Awaiting Analysis"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.