CVE-2022-49601

Q: What is the severity of CVE-2022-49601?

CVE-2022-49601 has a CVSS score of 4.7 (MEDIUM). This CVE describes a race condition vulnerability in the Linux kernel's TCP/DCCP implementation where concurrent reading and writing of the sysctl_tcp_fwmark_accept system control parameter can cause inconsistent behavior. It affects Linux systems using TCP or DCCP protocols with firewall mark acceptance functionality enabled. The vulnerability could lead to unexpected network behavior or potential security bypasses.

4.7 MEDIUM

📋 TL;DR

This CVE describes a race condition vulnerability in the Linux kernel's TCP/DCCP implementation where concurrent reading and writing of the sysctl_tcp_fwmark_accept system control parameter can cause inconsistent behavior. It affects Linux systems using TCP or DCCP protocols with firewall mark acceptance functionality enabled. The vulnerability could lead to unexpected network behavior or potential security bypasses.

💻 Affected Systems

Products:

Linux Kernel

Versions: Specific affected kernel versions not specified in CVE, but patches exist in stable kernel trees

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Only affects systems where sysctl_tcp_fwmark_accept is being used or modified. Most default configurations are not vulnerable.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

An attacker could potentially manipulate firewall marking behavior to bypass network security controls or cause denial of service by creating inconsistent network connection states.

🟠

Likely Case

Inconsistent firewall marking behavior leading to network connectivity issues or unexpected packet routing.

🟢

If Mitigated

Minimal impact with proper kernel patching and standard network security controls in place.

🌐 Internet-Facing: LOW - Requires local access or ability to manipulate kernel parameters, not directly exploitable over network.

🏢 Internal Only: MEDIUM - Could be exploited by local users or processes to affect network behavior on the host system.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: NO

Unauthenticated Exploit: ✅ No

Complexity: HIGH

Exploitation requires local access and ability to manipulate kernel parameters concurrently. Race conditions are difficult to reliably exploit.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Patched in stable kernel versions via the provided git commits

Vendor Advisory: https://git.kernel.org/stable/c/13207f9485b5de68decf296ceb0046f5eabb2485

Restart Required: Yes

Instructions:

1. Update Linux kernel to a patched version from your distribution's repositories. 2. Reboot the system to load the new kernel. 3. Verify the fix by checking kernel version.

🔧 Temporary Workarounds

Disable sysctl_tcp_fwmark_accept

linux

Set the sysctl parameter to 0 to disable firewall mark acceptance functionality

echo 0 > /proc/sys/net/ipv4/tcp_fwmark_accept

🧯 If You Can't Patch

Implement strict access controls to prevent unauthorized users from modifying kernel parameters
Monitor for unusual network behavior or attempts to modify sysctl parameters

🔍 How to Verify

Check if Vulnerable:

Check if your kernel version is affected by comparing with patched versions in the git commits. Use: uname -r

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version after update and ensure sysctl_tcp_fwmark_accept is either disabled or the system is using a patched kernel

📡 Detection & Monitoring

Log Indicators:

Kernel logs showing race condition warnings
Unexpected network connection failures

Network Indicators:

Inconsistent firewall marking behavior
Unexpected packet routing

SIEM Query:

Process monitoring for sysctl modifications or kernel parameter changes

📊 Metadata

CVE ID: CVE-2022-49601

CVSS v3 Score: 4.7 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-362

EPSS Score: 0.03% exploit probability (7.2th percentile)

Published: February 26, 2025

Last Updated: October 1, 2025

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable sysctl_tcp_fwmark_accept

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities