CVE-2022-48909 (GCVE-0-2022-48909)

Vulnerability from cvelistv5 – Published: 2024-08-22 01:30 – Updated: 2025-05-04 08:25
VLAI?
Title
net/smc: fix connection leak
Summary
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix connection leak There's a potential leak issue under following execution sequence : smc_release smc_connect_work if (sk->sk_state == SMC_INIT) send_clc_confirim tcp_abort(); ... sk.sk_state = SMC_ACTIVE smc_close_active switch(sk->sk_state) { ... case SMC_ACTIVE: smc_close_final() // then wait peer closed Unfortunately, tcp_abort() may discard CLC CONFIRM messages that are still in the tcp send buffer, in which case our connection token cannot be delivered to the server side, which means that we cannot get a passive close message at all. Therefore, it is impossible for the to be disconnected at all. This patch tries a very simple way to avoid this issue, once the state has changed to SMC_ACTIVE after tcp_abort(), we can actively abort the smc connection, considering that the state is SMC_INIT before tcp_abort(), abandoning the complete disconnection process should not cause too much problem. In fact, this problem may exist as long as the CLC CONFIRM message is not received by the server. Whether a timer should be added after smc_close_final() needs to be discussed in the future. But even so, this patch provides a faster release for connection in above case, it should also be valuable.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 39f41f367b08650e9aa314e3a13fb6dda1e9eec7 , < 2e8d465b83db307f04ad265848f8ab3f78f6918f (git)
Affected: 39f41f367b08650e9aa314e3a13fb6dda1e9eec7 , < 80895b6f9154fb22d36fab311ccbb75503a2c87b (git)
Affected: 39f41f367b08650e9aa314e3a13fb6dda1e9eec7 , < e98d46ccfa84b35a9e4b1ccdd83961b41a5d7ce5 (git)
Affected: 39f41f367b08650e9aa314e3a13fb6dda1e9eec7 , < 9f1c50cf39167ff71dc5953a3234f3f6eeb8fcb5 (git)
Create a notification for this product.
    Linux Linux Affected: 5.3
Unaffected: 0 , < 5.3 (semver)
Unaffected: 5.10.104 , ≤ 5.10.* (semver)
Unaffected: 5.15.27 , ≤ 5.15.* (semver)
Unaffected: 5.16.13 , ≤ 5.16.* (semver)
Unaffected: 5.17 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-48909",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:34:07.353240Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:33:11.908Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/smc/af_smc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2e8d465b83db307f04ad265848f8ab3f78f6918f",
              "status": "affected",
              "version": "39f41f367b08650e9aa314e3a13fb6dda1e9eec7",
              "versionType": "git"
            },
            {
              "lessThan": "80895b6f9154fb22d36fab311ccbb75503a2c87b",
              "status": "affected",
              "version": "39f41f367b08650e9aa314e3a13fb6dda1e9eec7",
              "versionType": "git"
            },
            {
              "lessThan": "e98d46ccfa84b35a9e4b1ccdd83961b41a5d7ce5",
              "status": "affected",
              "version": "39f41f367b08650e9aa314e3a13fb6dda1e9eec7",
              "versionType": "git"
            },
            {
              "lessThan": "9f1c50cf39167ff71dc5953a3234f3f6eeb8fcb5",
              "status": "affected",
              "version": "39f41f367b08650e9aa314e3a13fb6dda1e9eec7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/smc/af_smc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.3"
            },
            {
              "lessThan": "5.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.27",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.104",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.27",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16.13",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix connection leak\n\nThere\u0027s a potential leak issue under following execution sequence :\n\nsmc_release  \t\t\t\tsmc_connect_work\nif (sk-\u003esk_state == SMC_INIT)\n\t\t\t\t\tsend_clc_confirim\n\ttcp_abort();\n\t\t\t\t\t...\n\t\t\t\t\tsk.sk_state = SMC_ACTIVE\nsmc_close_active\nswitch(sk-\u003esk_state) {\n...\ncase SMC_ACTIVE:\n\tsmc_close_final()\n\t// then wait peer closed\n\nUnfortunately, tcp_abort() may discard CLC CONFIRM messages that are\nstill in the tcp send buffer, in which case our connection token cannot\nbe delivered to the server side, which means that we cannot get a\npassive close message at all. Therefore, it is impossible for the to be\ndisconnected at all.\n\nThis patch tries a very simple way to avoid this issue, once the state\nhas changed to SMC_ACTIVE after tcp_abort(), we can actively abort the\nsmc connection, considering that the state is SMC_INIT before\ntcp_abort(), abandoning the complete disconnection process should not\ncause too much problem.\n\nIn fact, this problem may exist as long as the CLC CONFIRM message is\nnot received by the server. Whether a timer should be added after\nsmc_close_final() needs to be discussed in the future. But even so, this\npatch provides a faster release for connection in above case, it should\nalso be valuable."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T08:25:54.512Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2e8d465b83db307f04ad265848f8ab3f78f6918f"
        },
        {
          "url": "https://git.kernel.org/stable/c/80895b6f9154fb22d36fab311ccbb75503a2c87b"
        },
        {
          "url": "https://git.kernel.org/stable/c/e98d46ccfa84b35a9e4b1ccdd83961b41a5d7ce5"
        },
        {
          "url": "https://git.kernel.org/stable/c/9f1c50cf39167ff71dc5953a3234f3f6eeb8fcb5"
        }
      ],
      "title": "net/smc: fix connection leak",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48909",
    "datePublished": "2024-08-22T01:30:51.686Z",
    "dateReserved": "2024-08-21T06:06:23.293Z",
    "dateUpdated": "2025-05-04T08:25:54.512Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-48909\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T15:34:07.353240Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:15.947Z\"}}], \"cna\": {\"title\": \"net/smc: fix connection leak\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"39f41f367b08\", \"lessThan\": \"2e8d465b83db\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"39f41f367b08\", \"lessThan\": \"80895b6f9154\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"39f41f367b08\", \"lessThan\": \"e98d46ccfa84\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"39f41f367b08\", \"lessThan\": \"9f1c50cf3916\", \"versionType\": \"git\"}], \"programFiles\": [\"net/smc/af_smc.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.3\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.3\", \"versionType\": \"custom\"}, {\"status\": \"unaffected\", \"version\": \"5.10.104\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.27\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"5.16.13\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"5.16.*\"}, {\"status\": \"unaffected\", \"version\": \"5.17\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/smc/af_smc.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/2e8d465b83db307f04ad265848f8ab3f78f6918f\"}, {\"url\": \"https://git.kernel.org/stable/c/80895b6f9154fb22d36fab311ccbb75503a2c87b\"}, {\"url\": \"https://git.kernel.org/stable/c/e98d46ccfa84b35a9e4b1ccdd83961b41a5d7ce5\"}, {\"url\": \"https://git.kernel.org/stable/c/9f1c50cf39167ff71dc5953a3234f3f6eeb8fcb5\"}], \"x_generator\": {\"engine\": \"bippy-c9c4e1df01b2\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/smc: fix connection leak\\n\\nThere\u0027s a potential leak issue under following execution sequence :\\n\\nsmc_release  \\t\\t\\t\\tsmc_connect_work\\nif (sk-\u003esk_state == SMC_INIT)\\n\\t\\t\\t\\t\\tsend_clc_confirim\\n\\ttcp_abort();\\n\\t\\t\\t\\t\\t...\\n\\t\\t\\t\\t\\tsk.sk_state = SMC_ACTIVE\\nsmc_close_active\\nswitch(sk-\u003esk_state) {\\n...\\ncase SMC_ACTIVE:\\n\\tsmc_close_final()\\n\\t// then wait peer closed\\n\\nUnfortunately, tcp_abort() may discard CLC CONFIRM messages that are\\nstill in the tcp send buffer, in which case our connection token cannot\\nbe delivered to the server side, which means that we cannot get a\\npassive close message at all. Therefore, it is impossible for the to be\\ndisconnected at all.\\n\\nThis patch tries a very simple way to avoid this issue, once the state\\nhas changed to SMC_ACTIVE after tcp_abort(), we can actively abort the\\nsmc connection, considering that the state is SMC_INIT before\\ntcp_abort(), abandoning the complete disconnection process should not\\ncause too much problem.\\n\\nIn fact, this problem may exist as long as the CLC CONFIRM message is\\nnot received by the server. Whether a timer should be added after\\nsmc_close_final() needs to be discussed in the future. But even so, this\\npatch provides a faster release for connection in above case, it should\\nalso be valuable.\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-08-22T03:30:41.084Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-48909\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-09-12T17:33:11.908Z\", \"dateReserved\": \"2024-08-21T06:06:23.293Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-08-22T01:30:51.686Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.