Executive brief
The Linux kernel's TCP networking stack contains an integer overflow vulnerability in the tcp_add_backlog() function. An attacker with network access can exploit this to cause a denial of service by crashing the kernel or triggering unpredictable behavior in TCP packet handling.
Technical details
A signed-integer-overflow vulnerability exists in tcp_add_backlog() (net/ipv4/tcp_ipv4.c), where the limit variable is calculated by adding sk_rcvbuf, sk_sndbuf, and a constant. Since sk_rcvbuf and sk_sndbuf are signed integers, their sum can exceed INT_MAX and overflow. The vulnerability is triggered during normal TCP packet processing when handling the backlog queue. The fix converts the calculation to unsigned 32-bit integers and halves sk_sndbuf in the computation, preventing the overflow. The patch was committed upstream by Lu Wei and applies across multiple stable kernel versions from 2.6.11 through 6.19.
Affected products
- Linux Linux Kernel 2.6.11 through 6.19
Timeline
- 2022-10-21: disclosed
- 2022-11-04: patched