Bug 2150272 (CVE-2022-4269)

Summary:	CVE-2022-4269 kernel: net: CPU soft lockup in TC mirred egress-to-ingress action
Product:	[Other] Security Response	Reporter:	Mauro Matteo Cascella <mcascell>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	acaringi, bhu, chwhite, crwood, ddepaula, debarbos, dvlasenk, ezulian, hkrzesin, jarod, jburrell, jfaracco, jferlan, jforbes, jlelli, joe.lawrence, jshortt, jstancek, jwyatt, kcarcia, kernel-mgr, lgoncalv, lleshchi, lzampier, mleitner, nmurray, ptalbert, qzhao, rvrbovsk, scweaver, steve.beattie, tyberry, vkumar, walters, williams
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	kernel 6.3-rc1	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the Linux kernel Traffic Control (TC) subsystem. Using a specific networking configuration (redirecting egress packets to ingress using TC action "mirred") a local unprivileged user could trigger a CPU soft lockup (ABBA deadlock) when the transport protocol in use (TCP or SCTP) does a retransmission, resulting in a denial of service condition.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-05-16 21:46:43 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2131339, 2150275, 2150276, 2150277, 2150278, 2164648, 2164649, 2164650, 2164655, 2164656, 2164657, 2164658, 2164659, 2164660, 2164661
Bug Blocks:	2150249

Description Mauro Matteo Cascella 2022-12-02 10:49:22 UTC

Using a specific networking configuration (that redirect egress packets to ingress using TC "mirred"), unprivileged users can trigger a soft-lockup (ABBA deadlock) in the Linux kernel, when the transport protocol in use (TCP or SCTP) does a retransmission.

Upstream discussion:
https://lore.kernel.org/netdev/33dc43f587ec1388ba456b4915c75f02a8aae226.1663945716.git.dcaratti@redhat.com/

Comment 1 Mauro Matteo Cascella 2022-12-02 11:01:05 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2150275]

Comment 5 Mauro Matteo Cascella 2022-12-02 11:27:04 UTC

For a general description of what a CPU soft lockup is, refer to https://access.redhat.com/articles/371803.

Comment 17 Mauro Matteo Cascella 2023-02-14 13:16:14 UTC

Upstream fix:
https://github.com/torvalds/linux/commit/ca22da2fbd69

Comment 18 errata-xmlrpc 2023-03-07 13:54:00 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2023:1130 https://access.redhat.com/errata/RHSA-2023:1130

Comment 19 errata-xmlrpc 2023-03-14 13:53:40 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2023:1202 https://access.redhat.com/errata/RHSA-2023:1202

Comment 20 errata-xmlrpc 2023-03-14 13:53:55 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2023:1202 https://access.redhat.com/errata/RHSA-2023:1202

Comment 21 errata-xmlrpc 2023-03-14 13:54:14 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2023:1203 https://access.redhat.com/errata/RHSA-2023:1203

Comment 22 errata-xmlrpc 2023-03-14 13:58:12 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Extended Update Support

Via RHSA-2023:1220 https://access.redhat.com/errata/RHSA-2023:1220

Comment 23 errata-xmlrpc 2023-03-14 13:58:39 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Extended Update Support

Via RHSA-2023:1221 https://access.redhat.com/errata/RHSA-2023:1221

Comment 25 errata-xmlrpc 2023-03-27 08:11:12 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:1469 https://access.redhat.com/errata/RHSA-2023:1469

Comment 26 errata-xmlrpc 2023-03-27 08:29:00 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:1470 https://access.redhat.com/errata/RHSA-2023:1470

Comment 29 errata-xmlrpc 2023-04-04 09:05:12 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:1584 https://access.redhat.com/errata/RHSA-2023:1584

Comment 30 errata-xmlrpc 2023-04-04 09:21:32 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:1566 https://access.redhat.com/errata/RHSA-2023:1566

Comment 31 Justin M. Forbes 2023-04-06 16:28:09 UTC

This was fixed for Fedora with the 6.2.9 stable kernel updates.

Comment 33 Product Security DevOps Team 2023-05-16 21:46:40 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-4269