CVE-2022-1678 : An issue was discovered in the Linux Kernel from 4.18 to 4.19, an improper updat

An issue was discovered in the Linux Kernel from 4.18 to 4.19, an improper update of sock reference in TCP pacing can lead to memory/netns leak, which can be used by remote clients.

Published 2022-05-25 15:15:08

Updated 2022-10-27 16:55:26

Source OpenAnolis

View at NVD, CVE.org

Products affected by CVE-2022-1678

Linux » Linux Kernel
Versions from including (>=) 4.18 and up to, including, (<=) 4.19
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Netapp » Element Software » Version: N/A
cpe:2.3:a:netapp:element_software:-:*:*:*:*:*:*:*
Matching versions
Netapp » Storagegrid » Version: N/A
cpe:2.3:a:netapp:storagegrid:-:*:*:*:*:*:*:*
Matching versions
Netapp » E-series Santricity Os Controller
Versions from including (>=) 11.0 and up to, including, (<=) 11.70.2
cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*
Matching versions
Netapp » Hci Management Node » Version: N/A
cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*
Matching versions
Netapp » Solidfire » Version: N/A
cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*
Matching versions
Netapp » Active Iq Unified Manager » Version: N/A For Vmware Vsphere
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
Matching versions
Netapp » Cloud Volumes Ontap Mediator » Version: N/A
cpe:2.3:a:netapp:cloud_volumes_ontap_mediator:-:*:*:*:*:*:*:*
Matching versions
Netapp » H410c Firmware » Version: N/A
cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » H410c » Version: N/A
Netapp » H300s Firmware » Version: N/A
cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » H300s » Version: N/A
Netapp » H500s Firmware » Version: N/A
cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » H500s » Version: N/A
Netapp » H700s Firmware » Version: N/A
cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » H700s » Version: N/A
Netapp » H300e Firmware » Version: N/A
cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » H300e » Version: N/A
Netapp » H500e Firmware » Version: N/A
cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » H500e » Version: N/A
Netapp » H700e Firmware » Version: N/A
cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » H700e » Version: N/A
Netapp » H410s Firmware » Version: N/A
cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » H410s » Version: N/A
Netapp » Bootstrap Os » Version: N/A
cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » Hci Compute Node » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2022-1678

EPSS FAQ

0.47%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 75 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-1678

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:N/A:P	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High
5.9	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H	2.2	3.6	OpenAnolis
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2022-1678

CWE-911 Improper Update of Reference Count

The product uses a reference count to manage a resource, but it does not update or incorrectly updates the reference count.

Assigned by: security@openanolis.org (Secondary)

References for CVE-2022-1678

https://security.netapp.com/advisory/ntap-20220715-0001/

CVE-2022-1678 Linux Kernel Vulnerability in NetApp Products | NetApp Product Security
Third Party Advisory
https://github.com/torvalds/linux/commit/0a70f118475e037732557796accd0878a00fc25a

tcp: fix possible socket leaks in internal pacing mode · torvalds/linux@0a70f11 · GitHub
Patch;Third Party Advisory
https://anas.openanolis.cn/errata/detail/ANSA-2022:0143

ANSA-2022:0143 - ANAS(OpenAnolis Advisory System)
Third Party Advisory
https://anas.openanolis.cn/cves/detail/CVE-2022-1678

CVE-2022-1678 - ANAS(OpenAnolis Advisory System)
Third Party Advisory
https://bugzilla.openanolis.cn/show_bug.cgi?id=61

61 – TCP sock leaks with BBR internal pacing
Issue Tracking;Patch;Third Party Advisory
https://lore.kernel.org/all/20200602080425.93712-1-kerneljasonxing@gmail.com/

[PATCH] tcp: fix TCP socks unreleased in BBR mode - kerneljasonxing
Exploit;Patch;Vendor Advisory
https://gitee.com/anolis/cloud-kernel/commit/bed537da691b

Login - Gitee
Permissions Required

Jump to

Vulnerability Details : CVE-2022-1678

Products affected by CVE-2022-1678

Exploit prediction scoring system (EPSS) score for CVE-2022-1678

CVSS scores for CVE-2022-1678

CWE ids for CVE-2022-1678

References for CVE-2022-1678