CVE-2022-50259

A flaw was found in the Linux kernel. A local user could exploit a race condition in the sock_map_free() function, which incorrectly calls release_sock(sk) without holding a proper reference to the socket. This can lead to a use-after-free vulnerability, potentially causing a system crash and resulting in a Denial of Service (DoS).

A use-after-free flaw was found in the Linux kernel's BPF sockmap implementation. The sock_map_free() function calls release_sock(sk) without owning a reference on the socket, so a local user able to create and tear down BPF sockmaps can trigger a race condition that causes a use-after-free and a system crash, resulting in a denial of service. Red Hat rates the impact of this issue as Low because exploitation requires local access with high privileges, the race condition is difficult to win, and the demonstrated impact is limited to system availability. This differs from the upstream CVE record, which assigns a higher severity (7.8, including high confidentiality and integrity impact); the available technical evidence, including the syzbot report, shows only an availability impact from the use-after-free and no indication of confidentiality or integrity impact. Red Hat Enterprise Linux 8 and 9, including the kernel-rt variant, are affected. The fix is currently deferred on the affected streams: given the low severity, the high privileges required, and the narrow timing window of the race, a fix will be delivered in a future planned update rather than as an urgent out-of-band fix. The residual risk is that a highly privileged local attacker able to use BPF sockmaps could crash the system, causing a denial of service. Red Hat Enterprise Linux 6, 7, and 10, and Red Hat In-Vehicle OS are not affected because the vulnerable code is not present in those products.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.