CVE-2022-4269: Medium severity Linux Linux kernel vulnerability
A flaw was found in the Linux kernel Traffic Control (TC) subsystem. Using a specific networking configuration (redirecting egress packets to ingress using TC action "mirred") a local unprivileged user could trigger a CPU soft lockup (ABBA deadlock) when the transport protocol in use (TCP or SCTP) does a retransmission, resulting in a denial of service condition.
Other sources
Using a specific networking configuration (that redirect egress packets to ingress using TC "mirred"), unprivileged users can trigger a soft-lockup (ABBA deadlock) in the Linux kernel, when the transport protocol in use (TCP or SCTP) does a retransmission.
Upstream discussion: https://lore.kernel.org/netdev/33dc43f587ec1388ba456b4915c75f02a8aae226.1663945716.git.dcaratti@redhat.com/
— Red Hat
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2022-4269?
CVE-2022-4269 is classified as a high-severity vulnerability due to its potential to cause a CPU soft lockup.
How do I fix CVE-2022-4269?
To fix CVE-2022-4269, users should upgrade to the appropriate patched version of the kernel as specified in the vulnerability details.
Which versions of the Linux kernel are affected by CVE-2022-4269?
CVE-2022-4269 affects multiple versions of the Linux kernel including certain kernel-rt and kernel packages up to version 5.14.0-162.22.2.
Is CVE-2022-4269 exploitable remotely?
CVE-2022-4269 is not considered exploitable remotely, as it requires local access to trigger the vulnerability.
What types of systems are impacted by CVE-2022-4269?
CVE-2022-4269 impacts systems running specific versions of the Linux kernel, particularly those configured to use the Traffic Control subsystem.