CVE-2022-49957

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-49957

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

I

n the Linux kernel, the following vulnerability has been resolved: kcm: fix strp_init() order and cleanup strp_init() is called just a few lines above this csk->sk_user_data check, it also initializes strp->work etc., therefore, it is unnecessary to call strp_done() to cancel the freshly initialized work. And if sk_user_data is already used by KCM, psock->strp should not be touched, particularly strp->work state, so we need to move strp_init() after the csk->sk_user_data check. This also makes a lockdep warning reported by syzbot go away.

References
Link Resource
https://git.kernel.org/stable/c/0946ff31d1a8778787bf6708beb20f38715267cc Patch
https://git.kernel.org/stable/c/1b6666964ca1de93a7bf06e122bcf3616dbd33a9 Patch
https://git.kernel.org/stable/c/473f394953216614087f4179e55cdf0cf616a13b Patch
https://git.kernel.org/stable/c/55fb8c3baa8071c5d533a9ad48624e44e2a04ef5 Patch
https://git.kernel.org/stable/c/8fc29ff3910f3af08a7c40a75d436b5720efe2bf Patch
https://git.kernel.org/stable/c/a8a0c321319ad64a5427d6172cd9c23b4d6ca1e8 Patch
https://git.kernel.org/stable/c/f865976baa85915c7672f351b74d5974b93215f6 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:4.15:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.0:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.0:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.0:rc3:*:*:*:*:*:*
History

14 Nov 2025, 18:10

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: kcm: corrección del orden y la limpieza de strp_init(). strp_init() se llama solo unas líneas por encima de la comprobación csk->sk_user_data; también inicializa strp->work, etc., por lo que no es necesario llamar a strp_done() para cancelar el trabajo recién inicializado. Si KCM ya utiliza sk_user_data, no se debe modificar psock->strp, en particular el estado strp->work, por lo que es necesario mover strp_init() después de la comprobación csk->sk_user_data. Esto también elimina la advertencia de lockdep reportada por syzbot.
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
First Time Linux linux Kernel
Linux
CWE CWE-908
CPE cpe:2.3:o:linux:linux_kernel:6.0:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.0:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:4.15:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.0:rc3:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/0946ff31d1a8778787bf6708beb20f38715267cc - () https://git.kernel.org/stable/c/0946ff31d1a8778787bf6708beb20f38715267cc - Patch
References () https://git.kernel.org/stable/c/1b6666964ca1de93a7bf06e122bcf3616dbd33a9 - () https://git.kernel.org/stable/c/1b6666964ca1de93a7bf06e122bcf3616dbd33a9 - Patch
References () https://git.kernel.org/stable/c/473f394953216614087f4179e55cdf0cf616a13b - () https://git.kernel.org/stable/c/473f394953216614087f4179e55cdf0cf616a13b - Patch
References () https://git.kernel.org/stable/c/55fb8c3baa8071c5d533a9ad48624e44e2a04ef5 - () https://git.kernel.org/stable/c/55fb8c3baa8071c5d533a9ad48624e44e2a04ef5 - Patch
References () https://git.kernel.org/stable/c/8fc29ff3910f3af08a7c40a75d436b5720efe2bf - () https://git.kernel.org/stable/c/8fc29ff3910f3af08a7c40a75d436b5720efe2bf - Patch
References () https://git.kernel.org/stable/c/a8a0c321319ad64a5427d6172cd9c23b4d6ca1e8 - () https://git.kernel.org/stable/c/a8a0c321319ad64a5427d6172cd9c23b4d6ca1e8 - Patch
References () https://git.kernel.org/stable/c/f865976baa85915c7672f351b74d5974b93215f6 - () https://git.kernel.org/stable/c/f865976baa85915c7672f351b74d5974b93215f6 - Patch

18 Jun 2025, 11:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-06-18 11:15

Updated : 2025-11-14 18:10

NVD link : CVE-2022-49957

Mitre link : CVE-2022-49957

CVE.ORG link : CVE-2022-49957

JSON object : View

Products Affected

linux

CWE
CWE-908

Use of Uninitialized Resource