Memory leak in Linux kernel - CVE-2022-1678

Vulnerability identifier: #VU93433

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-1678

CWE-ID: CWE-401

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due memory leak within the tcp_pace_kick() function in net/ipv4/tcp_output.c caused by an improper update of sock reference in TCP pacing. A remote attacker can force the system to leak memory and perform denial of service attack.

Linux kernel
Anolis OS
kernel-debug
python3-perf
perf
kernel-tools-libs-devel
kernel-tools-libs
kernel-tools
kernel-modules-internal
kernel-modules-extra
kernel-modules
kernel-headers
kernel-devel
kernel-debug-modules-extra
kernel-debug-modules
kernel-debug-devel
kernel-debug-core
kernel-core
kernel
bpftool
python-perf

Install updates from vendor's website.

kernel-debug - addressed in versions 4.19.91-25.6, 4.19.91-26
python3-perf - update to 4.19.91-25.6
perf - addressed in versions 4.19.91-25.6, 4.19.91-26
kernel-tools-libs-devel - addressed in versions 4.19.91-25.6, 4.19.91-26
kernel-tools-libs - addressed in versions 4.19.91-25.6, 4.19.91-26
kernel-tools - addressed in versions 4.19.91-25.6, 4.19.91-26
kernel-modules-internal - update to 4.19.91-25.6
kernel-modules-extra - update to 4.19.91-25.6
kernel-modules - update to 4.19.91-25.6
kernel-headers - addressed in versions 4.19.91-25.6, 4.19.91-26
kernel-devel - addressed in versions 4.19.91-25.6, 4.19.91-26
kernel-debug-modules-extra - update to 4.19.91-25.6
kernel-debug-modules - update to 4.19.91-25.6
kernel-debug-devel - addressed in versions 4.19.91-25.6, 4.19.91-26
kernel-debug-core - update to 4.19.91-25.6
kernel-core - update to 4.19.91-25.6
kernel - addressed in versions 4.19.91-25.6, 4.19.91-26
bpftool - addressed in versions 4.19.91-25.6, 4.19.91-26
python-perf - update to 4.19.91-26

• https://gitee.com/anolis/cloud-kernel/commit/bed537da691b
• https://bugzilla.openanolis.cn/show_bug.cgi?id=61
• https://lore.kernel.org/all/20200602080425.93712-1-kerneljasonxing@gmail.com/
• https://github.com/torvalds/linux/commit/0a70f118475e037732557796accd0878a00fc25a
• https://anas.openanolis.cn/cves/detail/CVE-2022-1678
• https://anas.openanolis.cn/errata/detail/ANSA-2022:0143
• https://security.netapp.com/advisory/ntap-20220715-0001/

• Remote denial of service in Linux Kernel
• Anolis OS update for kernel(ANCK)4.19
• Anolis OS update for kernel