DEBIAN-CVE-2022-50243

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2022-50243
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-50243.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2022-50243
Upstream
Published
2025-09-15T14:15:34Z
Modified
2025-09-30T05:18:39.982168Z
Summary
[none]
Details

In the Linux kernel, the following vulnerability has been resolved: sctp: handle the error returned from sctpauthasocinitactivekey When it returns an error from sctpauthasocinitactivekey(), the activekey is actually not updated. The old shkey will be freeed while it's still used as active key in asoc. Then an use-after-free will be triggered when sending patckets, as found by syzbot: sctpauthshkeyhold+0x22/0xa0 net/sctp/auth.c:112 sctpsetownerw net/sctp/socket.c:132 [inline] sctpsendmsgtoasoc+0xbd5/0x1a20 net/sctp/socket.c:1863 sctpsendmsg+0x1053/0x1d50 net/sctp/socket.c:2025 inetsendmsg+0x99/0xe0 net/ipv4/afinet.c:819 socksendmsgnosec net/socket.c:714 [inline] socksendmsg+0xcf/0x120 net/socket.c:734 This patch is to fix it by not replacing the shkey when it returns errors from sctpauthasocinitactivekey() in sctpauthsetkey(). For sctpauthsetactivekey(), old activekeyid will be set back to asoc->activekeyid when the same thing happens.

References

Affected packages

Debian:11 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.10.158-1

Affected versions

5.*

5.10.46-4
5.10.46-5
5.10.70-1~bpo10+1
5.10.70-1
5.10.84-1
5.10.92-1~bpo10+1
5.10.92-1
5.10.92-2
5.10.103-1~bpo10+1
5.10.103-1
5.10.106-1
5.10.113-1
5.10.120-1~bpo10+1
5.10.120-1
5.10.127-1
5.10.127-2~bpo10+1
5.10.127-2
5.10.136-1
5.10.140-1
5.10.148-1
5.10.149-1
5.10.149-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.0.3-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.0.3-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:14 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.0.3-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}