CVE-2022-3566: Linux Kernel TCP tcp_setsockopt race condition

A vulnerability was identified in Linux Kernel up to 4.19.316/5.4.278/5.10.220/5.15.161. This impacts the function tcpgetsockopt/tcpsetsockopt of the component TCP Handler. Such manipulation leads to race condition. A high complexity level is associated with this attack. The exploitability is said to be difficult. The vulnerability was introduced in 2.6.12, commit 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ("Linux-2.6.12-rc2"). Upgrading to version 4.19.317, 5.4.279, 5.10.221, 5.15.162 and 6.1 will fix this issue. The name of the patch is fcd31dd8291b23d713245947ec2b2d99ef07aef2/3b32f265805a49071e2c4568a524398ba22bf93c/d529193eae979a7bf2255cd9fe68b7af7a1c91b3/5bb642cc3355ffd3c8bca0a8bd8e6e65bcc2091c/f49cd2f4d6170d27a2c61f1fecb03d8a70c91f57. The affected component should be upgraded.

— MITRE

A vulnerability, which was classified as problematic, was found in Linux Kernel. This affects the function tcpgetsockopt/tcpsetsockopt of the component TCP Handler. The manipulation leads to race condition. It is recommended to apply a patch to fix this issue. The identifier VDB-211089 was assigned to this vulnerability.

setsockopt(IPV6ADDRFORM) and tcpv6connect() change icsk->icskafops under locksock(), but tcp(get|set)sockopt() read it locklessly causes data-race in tcpsetsockopt / tcpv6connect

Crash: BUG: KCSAN: data-race in tcpsetsockopt / tcpv6connect

write to 0xffff88813c624518 of 8 bytes by task 23936 on cpu 0: tcpv6connect+0x5b3/0xce0 net/ipv6/tcpipv6.c:240 inetstreamconnect+0x159/0x6d0 net/ipv4/afinet.c:660 inetstreamconnect+0x44/0x70 net/ipv4/afinet.c:724 sysconnectfile net/socket.c:1976 [inline] sysconnect+0x197/0x1b0 net/socket.c:1993 dosysconnect net/socket.c:2003 [inline] sesysconnect net/socket.c:2000 [inline] x64sysconnect+0x3d/0x50 net/socket.c:2000 dosyscallx64 arch/x86/entry/common.c:50 [inline] dosyscall64+0x2b/0x70 arch/x86/entry/common.c:80 entrySYSCALL64afterhwframe+0x63/0xcd

read to 0xffff88813c624518 of 8 bytes by task 23937 on cpu 1: tcpsetsockopt+0x147/0x1c80 net/ipv4/tcp.c:3789 sockcommonsetsockopt+0x5d/0x70 net/core/sock.c:3585 syssetsockopt+0x212/0x2b0 net/socket.c:2252 dosyssetsockopt net/socket.c:2263 [inline] sesyssetsockopt net/socket.c:2260 [inline] x64syssetsockopt+0x62/0x70 net/socket.c:2260 dosyscallx64 arch/x86/entry/common.c:50 [inline] dosyscall64+0x2b/0x70 arch/x86/entry/common.c:80 entrySYSCALL64afterhwframe+0x63/0xcd

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f49cd2f4d6170d27a2c61f1fecb03d8a70c91f57

— Red Hat