CVE-2022-49573: tcp: Fix a data-race around sysctl_tcp_early_retrans.
First published: Wed Feb 26 2025(Updated: )
In the Linux kernel, the following vulnerability has been resolved: tcp: Fix a data-race around sysctl_tcp_early_retrans. While reading sysctl_tcp_early_retrans, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader.
Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux Kernel | ||
| >=3.5<4.19.254 | ||
| >=4.20<5.4.208 | ||
| >=5.5<5.10.134 | ||
| >=5.11<5.15.58 | ||
| >=5.16<5.18.15 | ||
| =5.19-rc1 | ||
| =5.19-rc2 | ||
| =5.19-rc3 | ||
| =5.19-rc4 | ||
| =5.19-rc5 | ||
| =5.19-rc6 | ||
| =5.19-rc7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://git.kernel.org/stable/c/488d3ad98ef7cddce7054193dbae6b4349c6807d
- https://git.kernel.org/stable/c/83767fe800a311370330d4ec83aa76093b744a80
- https://git.kernel.org/stable/c/11e8b013d16e5db63f8f76acceb5b86964098aaa
- https://git.kernel.org/stable/c/5037ca9e4b169cc9aed0174d658c3d81fdaf8ea5
- https://git.kernel.org/stable/c/d5975f6376ce90c2c483ae36bf88c9cface4c13b
- https://git.kernel.org/stable/c/52e65865deb6a36718a463030500f16530eaab74
Frequently Asked Questions
What is the severity of CVE-2022-49573?
CVE-2022-49573 is classified as a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2022-49573?
To address CVE-2022-49573, upgrade the Linux kernel to a patched version that resolves the data race condition.
Which versions of the Linux kernel are affected by CVE-2022-49573?
CVE-2022-49573 affects multiple versions of the Linux kernel, specifically from 3.5 to 5.19-rc7.
What type of vulnerability is CVE-2022-49573?
CVE-2022-49573 is a data race vulnerability that occurs when reading the sysctl_tcp_early_retrans variable.
Can CVE-2022-49573 be exploited remotely?
CVE-2022-49573 does not have known remote exploitation potential, as it requires local access to the affected kernel.
- collector/mitre-cve
- source/MITRE
- agent/first-publish-date
- agent/type
- agent/title
- agent/references
- agent/author
- agent/source
- agent/description
- agent/guess-ai
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/weakness
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/event
- agent/tags
- collector/nvd-api
- source/NVD
- vendor/the linux foundation
- canonical/linux kernel
- vendor/linux