Bug 2150272 (CVE-2022-4269) - CVE-2022-4269 kernel: net: CPU soft lockup in TC mirred egress-to-ingress action
Summary: CVE-2022-4269 kernel: net: CPU soft lockup in TC mirred egress-to-ingress action
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2022-4269
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2131339 2150275 2150276 2150277 2150278 2164648 2164649 2164650 2164655 2164656 2164657 2164658 2164659 2164660 2164661
Blocks: 2150249
TreeView+ depends on / blocked
 
Reported: 2022-12-02 10:49 UTC by Mauro Matteo Cascella
Modified: 2023-05-16 21:46 UTC (History)
35 users (show)

Fixed In Version: kernel 6.3-rc1
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the Linux kernel Traffic Control (TC) subsystem. Using a specific networking configuration (redirecting egress packets to ingress using TC action "mirred") a local unprivileged user could trigger a CPU soft lockup (ABBA deadlock) when the transport protocol in use (TCP or SCTP) does a retransmission, resulting in a denial of service condition.
Clone Of:
Environment:
Last Closed: 2023-05-16 21:46:43 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2023:1531 0 None None None 2023-03-30 08:51:00 UTC
Red Hat Product Errata RHSA-2023:1130 0 None None None 2023-03-07 13:54:02 UTC
Red Hat Product Errata RHSA-2023:1202 0 None None None 2023-03-14 13:53:58 UTC
Red Hat Product Errata RHSA-2023:1203 0 None None None 2023-03-14 13:54:16 UTC
Red Hat Product Errata RHSA-2023:1220 0 None None None 2023-03-14 13:58:15 UTC
Red Hat Product Errata RHSA-2023:1221 0 None None None 2023-03-14 13:58:42 UTC
Red Hat Product Errata RHSA-2023:1469 0 None None None 2023-03-27 08:11:15 UTC
Red Hat Product Errata RHSA-2023:1470 0 None None None 2023-03-27 08:29:04 UTC
Red Hat Product Errata RHSA-2023:1566 0 None None None 2023-04-04 09:21:34 UTC
Red Hat Product Errata RHSA-2023:1584 0 None None None 2023-04-04 09:05:14 UTC

Description Mauro Matteo Cascella 2022-12-02 10:49:22 UTC 
Using a specific networking configuration (that redirect egress packets to ingress using TC "mirred"), unprivileged users can trigger a soft-lockup (ABBA deadlock) in the Linux kernel, when the transport protocol in use (TCP or SCTP) does a retransmission.

Upstream discussion:
https://lore.kernel.org/netdev/33dc43f587ec1388ba456b4915c75f02a8aae226.1663945716.git.dcaratti@redhat.com/
Comment 1 Mauro Matteo Cascella 2022-12-02 11:01:05 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2150275]
Comment 5 Mauro Matteo Cascella 2022-12-02 11:27:04 UTC 
For a general description of what a CPU soft lockup is, refer to https://access.redhat.com/articles/371803.
Comment 17 Mauro Matteo Cascella 2023-02-14 13:16:14 UTC 
Upstream fix:
https://github.com/torvalds/linux/commit/ca22da2fbd69
Comment 18 errata-xmlrpc 2023-03-07 13:54:00 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2023:1130 https://access.redhat.com/errata/RHSA-2023:1130
Comment 19 errata-xmlrpc 2023-03-14 13:53:40 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2023:1202 https://access.redhat.com/errata/RHSA-2023:1202
Comment 20 errata-xmlrpc 2023-03-14 13:53:55 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2023:1202 https://access.redhat.com/errata/RHSA-2023:1202
Comment 21 errata-xmlrpc 2023-03-14 13:54:14 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2023:1203 https://access.redhat.com/errata/RHSA-2023:1203
Comment 22 errata-xmlrpc 2023-03-14 13:58:12 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Extended Update Support

Via RHSA-2023:1220 https://access.redhat.com/errata/RHSA-2023:1220
Comment 23 errata-xmlrpc 2023-03-14 13:58:39 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Extended Update Support

Via RHSA-2023:1221 https://access.redhat.com/errata/RHSA-2023:1221
Comment 25 errata-xmlrpc 2023-03-27 08:11:12 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:1469 https://access.redhat.com/errata/RHSA-2023:1469
Comment 26 errata-xmlrpc 2023-03-27 08:29:00 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:1470 https://access.redhat.com/errata/RHSA-2023:1470
Comment 29 errata-xmlrpc 2023-04-04 09:05:12 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:1584 https://access.redhat.com/errata/RHSA-2023:1584
Comment 30 errata-xmlrpc 2023-04-04 09:21:32 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:1566 https://access.redhat.com/errata/RHSA-2023:1566
Comment 31 Justin M. Forbes 2023-04-06 16:28:09 UTC 
This was fixed for Fedora with the 6.2.9 stable kernel updates.
Comment 33 Product Security DevOps Team 2023-05-16 21:46:40 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-4269
Note You need to log in before you can comment on or make changes to this bug.