Critical Vulnerability in Linux Kernel: MPTCP Subflow Data Queueing Issue
Summary
CVE-2022-50070: In the Linux kernel, the following vulnerability has been resolved: mptcp: do not queue data on closed subflows Dipanjan reported a syzbot splat at close time: WARNING: CPU: 1 PID: 10818 at net/ipv4/af_inet.c:153 inet_so... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It supports various functionalities, including process management, memory management, and device control. The kernel is crucial for system stability and performance, making it vital to address any vulnerabilities that may arise. This specific vulnerability affects the MultiPath TCP (MPTCP) implementation, which allows for the use of multiple network paths for a single connection, enhancing reliability and throughput.
Vulnerability Detail
The vulnerability, identified as CVE-2022-50070, arises from a race condition in the MPTCP implementation where data can be queued on closed subflows. This issue can lead to a system crash or unexpected behavior when the packet scheduler attempts to (re)transmit data on a subflow that has already been closed. The root cause is a lack of proper locking mechanisms that allow for the possibility of operations on a closed socket, which can result in a kernel panic.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the available patches as soon as possible to mitigate the risk.
Conclusion
CVE-2022-50070 is a critical vulnerability in the Linux kernel that affects the MPTCP implementation. It is essential for users to update their systems to the patched versions to prevent potential system crashes and instability. Regular monitoring and timely updates are key to maintaining system security.
See every vulnerability recorded for linux →
FAQ
CVE-2022-50070 is a vulnerability in the Linux kernel's MPTCP implementation that allows data to be queued on closed subflows, potentially leading to system crashes.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without any signup.
If exploited, this vulnerability can lead to kernel panics, causing system instability and potential data loss.
Yes, patched versions of the Linux kernel are available. Users should update to version 6.0.2-1 for Debian 12 and 13.
While there are no specific workarounds, it is crucial to prioritize updating your kernel to mitigate the risks associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
