MPTCP Subflow Leak Vulnerability in Linux Kernel - CVE-2022-50071
Summary
CVE-2022-50071: In the Linux kernel, the following vulnerability has been resolved: mptcp: move subflow cleanup in mptcp_destroy_common() If the mptcp socket creation fails due to a CGROUP_INET_SOCK_CREATE eBPF program, the MPTCP protoc... Affects linux versions < 6.0.2-1. Fixed in 6.0.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, responsible for managing hardware resources and providing essential services to applications. It supports various networking protocols, including Multipath TCP (MPTCP), which allows for the use of multiple paths for a single TCP connection. This vulnerability affects the MPTCP implementation, specifically in how it handles subflow cleanup during socket creation failures.
Vulnerability Detail
CVE-2022-50071 is a vulnerability in the Linux kernel's MPTCP implementation that leads to a leak of subflow sockets when the creation of an MPTCP socket fails due to a CGROUP_INET_SOCK_CREATE eBPF program. The cleanup of these subflows is not executed in the failure path, resulting in resource leaks. This issue has existed since before the identified root cause commit, and any attempts to backport a fix prior to that commit would necessitate a complete rewrite.
How To Fix
Minimum fixed version
6.0.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. It is recommended to apply the patch as soon as it is available.
Conclusion
CVE-2022-50071 is a critical vulnerability in the Linux kernel's MPTCP implementation that can lead to resource leaks. It is essential to update to the patched version to mitigate any potential risks associated with this vulnerability. Regular monitoring and updates are crucial for maintaining system security.
See every vulnerability recorded for linux →
FAQ
CVE-2022-50071 is a vulnerability in the Linux kernel that causes subflow sockets to leak when MPTCP socket creation fails.
This vulnerability can lead to resource leaks, potentially affecting system performance and stability.
The vulnerability affects Linux versions prior to 6.0.2-1 in Debian 12 and 13.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
Yes, a patch is available in version 6.0.2-1 and later. It is recommended to update your Linux package to this version.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
