CVE-2022-49669
📋 TL;DR
A use-after-free vulnerability in the Linux kernel's MPTCP implementation allows attackers to potentially crash systems or execute arbitrary code. This affects Linux systems with MPTCP enabled, particularly those running vulnerable kernel versions. The vulnerability occurs when a listener socket closes while MPTCP subflows are still pending acceptance.
💻 Affected Systems
- Linux kernel
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Kernel panic leading to system crash or potential privilege escalation to kernel-level code execution, allowing complete system compromise.
Likely Case
System crash or denial of service due to kernel panic when the race condition is triggered, requiring system reboot.
If Mitigated
No impact if MPTCP is disabled or systems are patched; otherwise, system instability under specific network conditions.
🎯 Exploit Status
Exploitation requires triggering a specific race condition during MPTCP socket cleanup. Likely requires local access or network access to MPTCP services.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Linux kernel with commits 6aeed9045071f2252ff4e98fc13d1e304f33e5b0 and a8a3e95c74e48c2c9b07b81fafda9122993f2e12
Vendor Advisory: https://git.kernel.org/stable/c/6aeed9045071f2252ff4e98fc13d1e304f33e5b0
Restart Required: Yes
Instructions:
1. Update Linux kernel to version containing the fix commits. 2. For distributions: Use package manager (apt/yum/dnf) to update kernel package. 3. Reboot system to load new kernel.
🔧 Temporary Workarounds
Disable MPTCP
LinuxDisable Multipath TCP functionality if not required
sysctl -w net.mptcp.enabled=0
Add 'net.mptcp.enabled=0' to /etc/sysctl.conf
🧯 If You Can't Patch
- Disable MPTCP using sysctl commands
- Restrict network access to systems with MPTCP enabled
🔍 How to Verify
Check if Vulnerable:
Check if MPTCP is enabled: sysctl net.mptcp.enabled. Check kernel version against distribution security advisories.Check Version:
uname -rVerify Fix Applied:
Verify kernel version includes fix commits. Check syslog for kernel oops messages related to MPTCP.📡 Detection & Monitoring
Log Indicators:
- Kernel oops messages in /var/log/kern.log or dmesg
- System crashes or reboots
Network Indicators:
- Unexpected MPTCP connection failures
- Network service disruptions
SIEM Query:
source="kernel" AND ("MPTCP" OR "use-after-free" OR "general protection fault")