CVE-2022-50865
tcp: fix a signed-integer-overflow bug in tcp_add_backlog()
HIGH 7.5
At a glance
- Source
- NVD
- EPSS
- EPSS 0.53 % · percentile 45 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Deferred
Description
In the Linux kernel, the following vulnerability has been resolved: tcp: fix a signed-integer-overflow bug in tcp_add_backlog() The type of sk_rcvbuf and sk_sndbuf in struct sock is int, and in tcp_add_backlog(), the variable limit is caculated by adding sk_rcvbuf, sk_sndbuf and 64 * 1024, it may exceed the max value of int and overflow. This patch reduces the limit budget by halving the sndbuf to solve this issue since ACK packets are much smaller than the payload.
References
- https://git.kernel.org/stable/c/9d04b4d0feee12bce6bfe37f30d8e953d3c30368
- https://git.kernel.org/stable/c/4f23cb2be530785db284a685d1b1c30224d8a538
- https://git.kernel.org/stable/c/a85d39f14aa8a71e29cfb5eb5de02878a8779898
- https://git.kernel.org/stable/c/28addf029417d53b1df062b4c87feb7bc033cb5f
- https://git.kernel.org/stable/c/ec791d8149ff60c40ad2074af3b92a39c916a03f
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | Linux |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary) |
European references
- ENISA EUVD · EUVD-2022-55833
- GCVE · GCVE-0-2022-50865
CERT-FR advisories
- CERTFR-2026-AVI-0327 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0226 — Multiples vulnérabilités dans le noyau Linux de Red Hat · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0170 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0168 — Multiples vulnérabilités dans le noyau Linux de Red Hat · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0130 — Multiples vulnérabilités dans le noyau Linux de Red Hat · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected c9c3321257e1b95be9b375f811fb250162af8d39 < 9d04b4d0feee12bce6bfe37f30d8e953d3c30368 ; affected c9c3321257e1b95be9b375f811fb250162af8d39 < 4f23cb2be530785db284a685d1b1c30224d8a538 ; affected c9c3321257e1b95be9b375f811fb250162af8d39 < a85d39f14aa8a71e29cfb5eb5de02878a8779898 ; affected c9c3321257e1b95be9b375f811fb250162af8d39 < 28addf029417d53b1df062b4c87feb7bc033cb5f ; affected c9c3321257e1b95be9b375f811fb250162af8d39 < ec791d8149ff60c40ad2074af3b92a39c916a03f |
| Linux · Linux | affected 4.9 ; unaffected 0 < 4.9 ; unaffected 5.4.278 ≤ 5.4.* ; unaffected 5.10.153 ≤ 5.10.* ; unaffected 5.15.77 ≤ 5.15.* ; unaffected 6.0.7 ≤ 6.0.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |