CVE-2022-50569

Vulnerability

Overview

In the Linux kernel's IPComp (IP Payload Compression Protocol) implementation, a memory management flaw exists in the ipcomp_alloc_scratches() function. When memory allocation fails via alloc_percpu(), the global pointer ipcomp_scratches retains its previous, now-obsolete address instead of being updated to NULL [1]. This leaves the system in an inconsistent state.

Exploitation

Scenario

An attacker with the ability to trigger IPComp resource exhaustion—such as by consuming system memory—could cause ipcomp_alloc_scratches() to fail. The subsequent call to ipcomp_free_scratches() uses the stale ipcomp_scratches pointer. This leads to a vfree() on an already freed or non-existent virtual memory area, resulting in a kernel warning or potential crash [2]. No authentication is required, but the attacker must be able to influence memory allocation within the kernel's networking stack.

Impact

Successful exploitation causes a kernel panic or a system crash (denial of service). The incorrect vfree() call can corrupt kernel memory, potentially leading to privilege escalation, though the primary impact is availability [3].

Mitigation

The fix updates ipcomp_scratches to NULL when scratches are freed, preventing the use of a dangling pointer [4]. Patches have been backported to stable kernel trees. Users should apply the relevant kernel update to their distribution.