cve-2022-48909
Vulnerability from cvelistv5
Published
2024-08-22 01:30
Modified
2024-12-19 08:10
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix connection leak There's a potential leak issue under following execution sequence : smc_release smc_connect_work if (sk->sk_state == SMC_INIT) send_clc_confirim tcp_abort(); ... sk.sk_state = SMC_ACTIVE smc_close_active switch(sk->sk_state) { ... case SMC_ACTIVE: smc_close_final() // then wait peer closed Unfortunately, tcp_abort() may discard CLC CONFIRM messages that are still in the tcp send buffer, in which case our connection token cannot be delivered to the server side, which means that we cannot get a passive close message at all. Therefore, it is impossible for the to be disconnected at all. This patch tries a very simple way to avoid this issue, once the state has changed to SMC_ACTIVE after tcp_abort(), we can actively abort the smc connection, considering that the state is SMC_INIT before tcp_abort(), abandoning the complete disconnection process should not cause too much problem. In fact, this problem may exist as long as the CLC CONFIRM message is not received by the server. Whether a timer should be added after smc_close_final() needs to be discussed in the future. But even so, this patch provides a faster release for connection in above case, it should also be valuable.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/2e8d465b83db307f04ad265848f8ab3f78f6918fPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/80895b6f9154fb22d36fab311ccbb75503a2c87bPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/9f1c50cf39167ff71dc5953a3234f3f6eeb8fcb5Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e98d46ccfa84b35a9e4b1ccdd83961b41a5d7ce5Patch
Impacted products
Vendor Product Version
Linux Linux Version: 39f41f367b08650e9aa314e3a13fb6dda1e9eec7
Version: 39f41f367b08650e9aa314e3a13fb6dda1e9eec7
Version: 39f41f367b08650e9aa314e3a13fb6dda1e9eec7
Version: 39f41f367b08650e9aa314e3a13fb6dda1e9eec7
 Create a notification for this product.
   Linux Linux Version: 5.3
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-48909",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:34:07.353240Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:33:11.908Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/smc/af_smc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2e8d465b83db307f04ad265848f8ab3f78f6918f",
              "status": "affected",
              "version": "39f41f367b08650e9aa314e3a13fb6dda1e9eec7",
              "versionType": "git"
            },
            {
              "lessThan": "80895b6f9154fb22d36fab311ccbb75503a2c87b",
              "status": "affected",
              "version": "39f41f367b08650e9aa314e3a13fb6dda1e9eec7",
              "versionType": "git"
            },
            {
              "lessThan": "e98d46ccfa84b35a9e4b1ccdd83961b41a5d7ce5",
              "status": "affected",
              "version": "39f41f367b08650e9aa314e3a13fb6dda1e9eec7",
              "versionType": "git"
            },
            {
              "lessThan": "9f1c50cf39167ff71dc5953a3234f3f6eeb8fcb5",
              "status": "affected",
              "version": "39f41f367b08650e9aa314e3a13fb6dda1e9eec7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/smc/af_smc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.3"
            },
            {
              "lessThan": "5.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.27",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix connection leak\n\nThere\u0027s a potential leak issue under following execution sequence :\n\nsmc_release  \t\t\t\tsmc_connect_work\nif (sk-\u003esk_state == SMC_INIT)\n\t\t\t\t\tsend_clc_confirim\n\ttcp_abort();\n\t\t\t\t\t...\n\t\t\t\t\tsk.sk_state = SMC_ACTIVE\nsmc_close_active\nswitch(sk-\u003esk_state) {\n...\ncase SMC_ACTIVE:\n\tsmc_close_final()\n\t// then wait peer closed\n\nUnfortunately, tcp_abort() may discard CLC CONFIRM messages that are\nstill in the tcp send buffer, in which case our connection token cannot\nbe delivered to the server side, which means that we cannot get a\npassive close message at all. Therefore, it is impossible for the to be\ndisconnected at all.\n\nThis patch tries a very simple way to avoid this issue, once the state\nhas changed to SMC_ACTIVE after tcp_abort(), we can actively abort the\nsmc connection, considering that the state is SMC_INIT before\ntcp_abort(), abandoning the complete disconnection process should not\ncause too much problem.\n\nIn fact, this problem may exist as long as the CLC CONFIRM message is\nnot received by the server. Whether a timer should be added after\nsmc_close_final() needs to be discussed in the future. But even so, this\npatch provides a faster release for connection in above case, it should\nalso be valuable."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-19T08:10:18.459Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2e8d465b83db307f04ad265848f8ab3f78f6918f"
        },
        {
          "url": "https://git.kernel.org/stable/c/80895b6f9154fb22d36fab311ccbb75503a2c87b"
        },
        {
          "url": "https://git.kernel.org/stable/c/e98d46ccfa84b35a9e4b1ccdd83961b41a5d7ce5"
        },
        {
          "url": "https://git.kernel.org/stable/c/9f1c50cf39167ff71dc5953a3234f3f6eeb8fcb5"
        }
      ],
      "title": "net/smc: fix connection leak",
      "x_generator": {
        "engine": "bippy-5f407fcff5a0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48909",
    "datePublished": "2024-08-22T01:30:51.686Z",
    "dateReserved": "2024-08-21T06:06:23.293Z",
    "dateUpdated": "2024-12-19T08:10:18.459Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-48909\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-08-22T02:15:05.333\",\"lastModified\":\"2024-09-12T13:36:11.253\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/smc: fix connection leak\\n\\nThere\u0027s a potential leak issue under following execution sequence :\\n\\nsmc_release  \\t\\t\\t\\tsmc_connect_work\\nif (sk-\u003esk_state == SMC_INIT)\\n\\t\\t\\t\\t\\tsend_clc_confirim\\n\\ttcp_abort();\\n\\t\\t\\t\\t\\t...\\n\\t\\t\\t\\t\\tsk.sk_state = SMC_ACTIVE\\nsmc_close_active\\nswitch(sk-\u003esk_state) {\\n...\\ncase SMC_ACTIVE:\\n\\tsmc_close_final()\\n\\t// then wait peer closed\\n\\nUnfortunately, tcp_abort() may discard CLC CONFIRM messages that are\\nstill in the tcp send buffer, in which case our connection token cannot\\nbe delivered to the server side, which means that we cannot get a\\npassive close message at all. Therefore, it is impossible for the to be\\ndisconnected at all.\\n\\nThis patch tries a very simple way to avoid this issue, once the state\\nhas changed to SMC_ACTIVE after tcp_abort(), we can actively abort the\\nsmc connection, considering that the state is SMC_INIT before\\ntcp_abort(), abandoning the complete disconnection process should not\\ncause too much problem.\\n\\nIn fact, this problem may exist as long as the CLC CONFIRM message is\\nnot received by the server. Whether a timer should be added after\\nsmc_close_final() needs to be discussed in the future. But even so, this\\npatch provides a faster release for connection in above case, it should\\nalso be valuable.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/smc: reparar fuga de conexi\u00f3n Hay un posible problema de fuga en la siguiente secuencia de ejecuci\u00f3n: smc_release smc_connect_work if (sk-\u0026gt;sk_state == SMC_INIT) send_clc_confirim tcp_abort(); ... sk.sk_state = SMC_ACTIVE smc_close_active switch(sk-\u0026gt;sk_state) { ... case SMC_ACTIVE: smc_close_final() // luego espera el par cerrado Desafortunadamente, tcp_abort() puede descartar los mensajes CLC CONFIRM que todav\u00eda est\u00e1n en el b\u00fafer de env\u00edo tcp , en cuyo caso nuestro token de conexi\u00f3n no se puede entregar al lado del servidor, lo que significa que no podemos recibir ning\u00fan mensaje de cierre pasivo. Por lo tanto, es imposible desconectarlo en absoluto. Este parche intenta una forma muy sencilla de evitar este problema, una vez que el estado ha cambiado a SMC_ACTIVE despu\u00e9s de tcp_abort(), podemos cancelar activamente la conexi\u00f3n smc, considerando que el estado es SMC_INIT antes de tcp_abort(), abandonar el proceso de desconexi\u00f3n completo no deber\u00eda causar demasiado problema. De hecho, este problema puede existir siempre y cuando el servidor no reciba el mensaje CONFIRM CLC. En el futuro se deber\u00e1 discutir si se debe agregar un temporizador despu\u00e9s de smc_close_final(). Pero aun as\u00ed, este parche proporciona una liberaci\u00f3n m\u00e1s r\u00e1pida para la conexi\u00f3n. En el caso anterior, tambi\u00e9n deber\u00eda ser valioso.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-401\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.3\",\"versionEndExcluding\":\"5.10.104\",\"matchCriteriaId\":\"C340B44A-7A5B-4A6D-AB90-C8B64B25908B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.27\",\"matchCriteriaId\":\"B3A8E092-3021-4A34-8DCE-B89D2238818B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.16.13\",\"matchCriteriaId\":\"B871B667-EDC0-435D-909E-E918D8D90995\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.17:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"7BD5F8D9-54FA-4CB0-B4F0-CB0471FDDB2D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.17:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"E6E34B23-78B4-4516-9BD8-61B33F4AC49A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.17:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"C030FA3D-03F4-4FB9-9DBF-D08E5CAC51AA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.17:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"B2D2677C-5389-4AE9-869D-0F881E80D923\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.17:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"EFA3917C-C322-4D92-912D-ECE45B2E7416\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.17:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"BED18363-5ABC-4639-8BBA-68E771E5BB3F\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2e8d465b83db307f04ad265848f8ab3f78f6918f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/80895b6f9154fb22d36fab311ccbb75503a2c87b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9f1c50cf39167ff71dc5953a3234f3f6eeb8fcb5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e98d46ccfa84b35a9e4b1ccdd83961b41a5d7ce5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-48909\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T15:34:07.353240Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:15.947Z\"}}], \"cna\": {\"title\": \"net/smc: fix connection leak\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"39f41f367b08\", \"lessThan\": \"2e8d465b83db\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"39f41f367b08\", \"lessThan\": \"80895b6f9154\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"39f41f367b08\", \"lessThan\": \"e98d46ccfa84\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"39f41f367b08\", \"lessThan\": \"9f1c50cf3916\", \"versionType\": \"git\"}], \"programFiles\": [\"net/smc/af_smc.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.3\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.3\", \"versionType\": \"custom\"}, {\"status\": \"unaffected\", \"version\": \"5.10.104\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.27\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"5.16.13\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"5.16.*\"}, {\"status\": \"unaffected\", \"version\": \"5.17\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/smc/af_smc.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/2e8d465b83db307f04ad265848f8ab3f78f6918f\"}, {\"url\": \"https://git.kernel.org/stable/c/80895b6f9154fb22d36fab311ccbb75503a2c87b\"}, {\"url\": \"https://git.kernel.org/stable/c/e98d46ccfa84b35a9e4b1ccdd83961b41a5d7ce5\"}, {\"url\": \"https://git.kernel.org/stable/c/9f1c50cf39167ff71dc5953a3234f3f6eeb8fcb5\"}], \"x_generator\": {\"engine\": \"bippy-c9c4e1df01b2\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/smc: fix connection leak\\n\\nThere\u0027s a potential leak issue under following execution sequence :\\n\\nsmc_release  \\t\\t\\t\\tsmc_connect_work\\nif (sk-\u003esk_state == SMC_INIT)\\n\\t\\t\\t\\t\\tsend_clc_confirim\\n\\ttcp_abort();\\n\\t\\t\\t\\t\\t...\\n\\t\\t\\t\\t\\tsk.sk_state = SMC_ACTIVE\\nsmc_close_active\\nswitch(sk-\u003esk_state) {\\n...\\ncase SMC_ACTIVE:\\n\\tsmc_close_final()\\n\\t// then wait peer closed\\n\\nUnfortunately, tcp_abort() may discard CLC CONFIRM messages that are\\nstill in the tcp send buffer, in which case our connection token cannot\\nbe delivered to the server side, which means that we cannot get a\\npassive close message at all. Therefore, it is impossible for the to be\\ndisconnected at all.\\n\\nThis patch tries a very simple way to avoid this issue, once the state\\nhas changed to SMC_ACTIVE after tcp_abort(), we can actively abort the\\nsmc connection, considering that the state is SMC_INIT before\\ntcp_abort(), abandoning the complete disconnection process should not\\ncause too much problem.\\n\\nIn fact, this problem may exist as long as the CLC CONFIRM message is\\nnot received by the server. Whether a timer should be added after\\nsmc_close_final() needs to be discussed in the future. But even so, this\\npatch provides a faster release for connection in above case, it should\\nalso be valuable.\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-08-22T03:30:41.084Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-48909\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-09-12T17:33:11.908Z\", \"dateReserved\": \"2024-08-21T06:06:23.293Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-08-22T01:30:51.686Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.