CVE-2022-48786
Description
A vulnerability was found in the Linux kernel's vsock subsystem's vsock_stream_connect() function where improper handling of the socket state can lead to the connected table's list being corrupted. This occurs when a signal interrupt occurs and resets the socket's state without removing it from the connected table; the process then attempts the connect() function again, which if successful, can lead to the socket being added a second time to the connected table, corrupting the linked list structure used for managing connected sockets. This vulnerability can potentially lead to memory corruption and system instability.
Statement
This issue is fixed in RHEL-9.1 and above
in (rhel-8.7, rhel-8.8, rhel-8.9, rhel-8.10) vsock: remove vsock from connected table when connect is interrupted by a signal
in (rhel-9.1, rhel-9.2, rhel-9.3, rhel-9.4, rhel-9.5) vsock: remove vsock from connected table when connect is interrupted by a signal
Please note that while RHEL-9 kernel-rt still appears as affected, it has been fixed in the same RHSA as RHEL-9 kernel. This is because from RHEL-9.3 onwards, the kernel and kernel-rt fixes are bundled together in a single errata.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.4 | 5.5 | 7.8 |
| Attack Vector | Local | Local | Local |
| Attack Complexity | Low | Low | Low |
| Privileges Required | Low | Low | Low |
| User Interaction | None | None | None |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | None | None | High |
| Integrity Impact | Low | None | High |
| Availability Impact | Low | High | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Application Data
Generally this error will cause the data structure to not work properly by truncating the data.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
