CVE-2022-4128: Null Pointer Dereference
A NULL pointer dereference issue was discovered in the Linux kernel in the MPTCP protocol when traversing the subflow list at disconnect time. A local user could use this flaw to potentially crash the system causing a denial of service.
Other sources
A NULL pointer dereference issue was discovered in the Linux kernel. This issue occurs in the MPTCP protocol when traversing the subflow list at disconnect time. A local user could potentially crash the system, causing a denial of service.
At disconnect time the MPTCP protocol traverse the subflows list closing each of them. In some circumstances - MPJ subflow, passive MPTCP socket, the latter operation can remove the subflow from the list, invalidating the current iterator. This could lead to a NULL pointer dereference issue.
Upstream patch & commit: https://lore.kernel.org/netdev/20220708233610.410786-2-mathew.j.martineau@linux.intel.com/ https://github.com/torvalds/linux/commit/5c835bb142d4
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:5.14.0-284.11.1.el9_2 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:5.14.0-284.11.1.rt14.296.el9_2 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.19
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2022-4128?
CVE-2022-4128 has been classified with a severity level of high due to its potential to cause a denial of service.
How do I fix CVE-2022-4128?
To remediate CVE-2022-4128, upgrade to kernel version 0:5.14.0-284.11.1.el9_2 or higher.
Who is affected by CVE-2022-4128?
CVE-2022-4128 affects local users on systems running vulnerable versions of the Linux kernel with MPTCP protocol.
What is the impact of CVE-2022-4128?
The impact of CVE-2022-4128 is that it could allow a local user to crash the system, resulting in a denial of service.
Is CVE-2022-4128 a remote or local vulnerability?
CVE-2022-4128 is a local vulnerability, as it requires access to the affected system to exploit.