In the Linux kernel, the following vulnerability has been resolved:

tcp: add sanity tests to TCP_QUEUE_SEQ

Qingyu Li reported a syzkaller bug where the repro
changes RCV SEQ _after_ restoring data in the receive queue.

mprotect(0x4aa000, 12288, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
socket(AF_INET6, SOCK_STREAM, IPPROTO_IP) = 3
setsockopt(3, SOL_TCP, TCP_REPAIR, [1], 4) = 0
connect(3, {sa_family=AF_INET6, sin6_port=htons(0), sin6_flowinfo=htonl(0), inet_pton(AF_INET6, "::1", &sin6_addr), sin6_scope_id=0}, 28) = 0
setsockopt(3, SOL_TCP, TCP_REPAIR_QUEUE, [1], 4) = 0
sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="0x0000000000000003\0\0", iov_len=20}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 20
setsockopt(3, SOL_TCP, TCP_REPAIR, [0], 4) = 0
setsockopt(3, SOL_TCP, TCP_QUEUE_SEQ, [128], 4) = 0
recvfrom(3, NULL, 20, 0, NULL, NULL) = -1 ECONNRESET (Connection reset by peer)

syslog shows:
[ 111.205099] TCP recvmsg seq # bug 2: copied 80, seq 0, rcvnxt 80, fl 0
[ 111.207894] WARNING: CPU: 1 PID: 356 at net/ipv4/tcp.c:2343 tcp_recvmsg_locked+0x90e/0x29a0

This should not be allowed. TCP_QUEUE_SEQ should only be used
when queues are empty.

This patch fixes this case, and the tx path as well.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00023.

Exploitation none

Automatable no

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
ee9952831cfd0bbe834f4a26489d7dce74582e37 affected < 319f460237fc2965a80aa9a055044e1da7b3692a
ee9952831cfd0bbe834f4a26489d7dce74582e37 affected < 3bf899438c123c444f6b644a57784dfbb6b15ad6
ee9952831cfd0bbe834f4a26489d7dce74582e37 affected < 046f3c1c2ff450fb7ae53650e9a95e0074a61f3e
ee9952831cfd0bbe834f4a26489d7dce74582e37 affected < 3b72d5a703842f582502d97906f17d6ee122dac2
ee9952831cfd0bbe834f4a26489d7dce74582e37 affected < 8811f4a9836e31c14ecdf79d9f3cb7c5d463265d
Linux Linux affected
Version Status Constraints
3.5 affected —
0 unaffected < 3.5
4.19.181 unaffected ≤ 4.19.*
5.4.106 unaffected ≤ 5.4.*
5.10.24 unaffected ≤ 5.10.*
5.11.7 unaffected ≤ 5.11.*
5.12 unaffected ≤ *

Configuration 1 [-]

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.12:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.12:rc2:*:*:*:*:*:*
Package CPE Advisory Released Date
Red Hat Enterprise Linux 8
kernel-0:4.18.0-348.el8 cpe:/o:redhat:enterprise_linux:8 RHSA-2021:4356 2021-11-09T00:00:00Z

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Redhat Subscribe
Enterprise Linux Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/046f3c1c2ff450fb7ae53650e9a95e0074a61f3e cve-icon cve-icon
https://git.kernel.org/stable/c/319f460237fc2965a80aa9a055044e1da7b3692a cve-icon cve-icon
https://git.kernel.org/stable/c/3b72d5a703842f582502d97906f17d6ee122dac2 cve-icon cve-icon
https://git.kernel.org/stable/c/3bf899438c123c444f6b644a57784dfbb6b15ad6 cve-icon cve-icon
https://git.kernel.org/stable/c/8811f4a9836e31c14ecdf79d9f3cb7c5d463265d cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2024082945-CVE-2021-4442-0a5f@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2021-4442 cve-icon
https://www.cve.org/CVERecord?id=CVE-2021-4442 cve-icon
History

Thu, 14 Nov 2024 02:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat
Redhat enterprise Linux
CPEs cpe:/o:redhat:enterprise_linux:8
Vendors & Products Redhat
Redhat enterprise Linux

Fri, 25 Oct 2024 14:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-20

Thu, 12 Sep 2024 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
Weaknesses NVD-CWE-noinfo
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.12:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.12:rc2:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel

Wed, 11 Sep 2024 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 30 Aug 2024 13:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Thu, 29 Aug 2024 09:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: tcp: add sanity tests to TCP_QUEUE_SEQ Qingyu Li reported a syzkaller bug where the repro changes RCV SEQ _after_ restoring data in the receive queue. mprotect(0x4aa000, 12288, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 socket(AF_INET6, SOCK_STREAM, IPPROTO_IP) = 3 setsockopt(3, SOL_TCP, TCP_REPAIR, [1], 4) = 0 connect(3, {sa_family=AF_INET6, sin6_port=htons(0), sin6_flowinfo=htonl(0), inet_pton(AF_INET6, "::1", &sin6_addr), sin6_scope_id=0}, 28) = 0 setsockopt(3, SOL_TCP, TCP_REPAIR_QUEUE, [1], 4) = 0 sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="0x0000000000000003\0\0", iov_len=20}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 20 setsockopt(3, SOL_TCP, TCP_REPAIR, [0], 4) = 0 setsockopt(3, SOL_TCP, TCP_QUEUE_SEQ, [128], 4) = 0 recvfrom(3, NULL, 20, 0, NULL, NULL) = -1 ECONNRESET (Connection reset by peer) syslog shows: [ 111.205099] TCP recvmsg seq # bug 2: copied 80, seq 0, rcvnxt 80, fl 0 [ 111.207894] WARNING: CPU: 1 PID: 356 at net/ipv4/tcp.c:2343 tcp_recvmsg_locked+0x90e/0x29a0 This should not be allowed. TCP_QUEUE_SEQ should only be used when queues are empty. This patch fixes this case, and the tx path as well.
Title tcp: add sanity tests to TCP_QUEUE_SEQ
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2025-05-04T06:59:56.297Z

Reserved: 2024-08-29T09:00:39.580Z

Link: CVE-2021-4442

cve-icon Vulnrichment

Updated: 2024-09-11T12:42:13.911Z

cve-icon NVD

Status : Analyzed

Published: 2024-08-29T11:15:23.413

Modified: 2024-09-12T16:58:07.427

Link: CVE-2021-4442

cve-icon Redhat

Severity : Moderate

Publid Date: 2024-08-29T00:00:00Z

Links: CVE-2021-4442 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses