{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2022-49018","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-08-22T01:27:53.646Z","datePublished":"2024-10-21T20:06:26.627Z","dateUpdated":"2025-05-04T12:44:10.838Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2025-05-04T12:44:10.838Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: fix sleep in atomic at close time\n\nMatt reported a splat at msk close time:\n\n    BUG: sleeping function called from invalid context at net/mptcp/protocol.c:2877\n    in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 155, name: packetdrill\n    preempt_count: 201, expected: 0\n    RCU nest depth: 0, expected: 0\n    4 locks held by packetdrill/155:\n    #0: ffff888001536990 (&sb->s_type->i_mutex_key#6){+.+.}-{3:3}, at: __sock_release (net/socket.c:650)\n    #1: ffff88800b498130 (sk_lock-AF_INET){+.+.}-{0:0}, at: mptcp_close (net/mptcp/protocol.c:2973)\n    #2: ffff88800b49a130 (sk_lock-AF_INET/1){+.+.}-{0:0}, at: __mptcp_close_ssk (net/mptcp/protocol.c:2363)\n    #3: ffff88800b49a0b0 (slock-AF_INET){+...}-{2:2}, at: __lock_sock_fast (include/net/sock.h:1820)\n    Preemption disabled at:\n    0x0\n    CPU: 1 PID: 155 Comm: packetdrill Not tainted 6.1.0-rc5 #365\n    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\n    Call Trace:\n    <TASK>\n    dump_stack_lvl (lib/dump_stack.c:107 (discriminator 4))\n    __might_resched.cold (kernel/sched/core.c:9891)\n    __mptcp_destroy_sock (include/linux/kernel.h:110)\n    __mptcp_close (net/mptcp/protocol.c:2959)\n    mptcp_subflow_queue_clean (include/net/sock.h:1777)\n    __mptcp_close_ssk (net/mptcp/protocol.c:2363)\n    mptcp_destroy_common (net/mptcp/protocol.c:3170)\n    mptcp_destroy (include/net/sock.h:1495)\n    __mptcp_destroy_sock (net/mptcp/protocol.c:2886)\n    __mptcp_close (net/mptcp/protocol.c:2959)\n    mptcp_close (net/mptcp/protocol.c:2974)\n    inet_release (net/ipv4/af_inet.c:432)\n    __sock_release (net/socket.c:651)\n    sock_close (net/socket.c:1367)\n    __fput (fs/file_table.c:320)\n    task_work_run (kernel/task_work.c:181 (discriminator 1))\n    exit_to_user_mode_prepare (include/linux/resume_user_mode.h:49)\n    syscall_exit_to_user_mode (kernel/entry/common.c:130)\n    do_syscall_64 (arch/x86/entry/common.c:87)\n    entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120)\n\nWe can't call mptcp_close under the 'fast' socket lock variant, replace\nit with a sock_lock_nested() as the relevant code is already under the\nlistening msk socket lock protection."}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/mptcp/subflow.c"],"versions":[{"version":"30e51b923e436b631e8d5b77fa5e318c6b066dc7","lessThan":"d8e6c5500dbf0f3e87aace90d4beba6ae928e866","status":"affected","versionType":"git"},{"version":"30e51b923e436b631e8d5b77fa5e318c6b066dc7","lessThan":"b4f166651d03b5484fa179817ba8ad4899a5a6ac","status":"affected","versionType":"git"},{"version":"b41808bfa049d1bc7ce8ce1ad4d591f7d203ebb9","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/mptcp/subflow.c"],"versions":[{"version":"6.0","status":"affected"},{"version":"0","lessThan":"6.0","status":"unaffected","versionType":"semver"},{"version":"6.0.12","lessThanOrEqual":"6.0.*","status":"unaffected","versionType":"semver"},{"version":"6.1","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.0.12"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.1"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19.14"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/d8e6c5500dbf0f3e87aace90d4beba6ae928e866"},{"url":"https://git.kernel.org/stable/c/b4f166651d03b5484fa179817ba8ad4899a5a6ac"}],"title":"mptcp: fix sleep in atomic at close time","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2022-49018","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-10-22T13:12:58.392450Z"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-10-22T13:18:37.571Z"}}]}}