CVE-2022-48906

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mptcp: Correctly set DATA_FIN timeout when number of retransmits is large<br /> <br /> Syzkaller with UBSAN uncovered a scenario where a large number of<br /> DATA_FIN retransmits caused a shift-out-of-bounds in the DATA_FIN<br /> timeout calculation:<br /> <br /> ================================================================================<br /> UBSAN: shift-out-of-bounds in net/mptcp/protocol.c:470:29<br /> shift exponent 32 is too large for 32-bit type &amp;#39;unsigned int&amp;#39;<br /> CPU: 1 PID: 13059 Comm: kworker/1:0 Not tainted 5.17.0-rc2-00630-g5fbf21c90c60 #1<br /> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014<br /> Workqueue: events mptcp_worker<br /> Call Trace:<br /> <br /> __dump_stack lib/dump_stack.c:88 [inline]<br /> dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106<br /> ubsan_epilogue+0xb/0x5a lib/ubsan.c:151<br /> __ubsan_handle_shift_out_of_bounds.cold+0xb2/0x20e lib/ubsan.c:330<br /> mptcp_set_datafin_timeout net/mptcp/protocol.c:470 [inline]<br /> __mptcp_retrans.cold+0x72/0x77 net/mptcp/protocol.c:2445<br /> mptcp_worker+0x58a/0xa70 net/mptcp/protocol.c:2528<br /> process_one_work+0x9df/0x16d0 kernel/workqueue.c:2307<br /> worker_thread+0x95/0xe10 kernel/workqueue.c:2454<br /> kthread+0x2f4/0x3b0 kernel/kthread.c:377<br /> ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295<br /> <br /> ================================================================================<br /> <br /> This change limits the maximum timeout by limiting the size of the<br /> shift, which keeps all intermediate values in-bounds.