CVE-2022-50706

Root

Cause

In the Linux kernel, the net/ieee802154 subsystem's raw socket implementation allowed a zero-length sendmsg() call (i.e., an empty network packet) to reach __dev_queue_xmit(). When the network stack later called skb_assert_len() on the zero-length skb, it triggered a warning (WARN_ON_ONCE), creating a splat in kernel logs [1].

Attack

Surface

The vulnerability is exploitable by any local user who can create a PF_IEEE802154 SOCK_RAW socket and call sendmsg() with an empty iovec. No special privileges or network access are required, and the attack can target a loopback address [1]. A simple proof-of-concept found in syzbot reports demonstrates the ease of triggering the warning [1].

Impact

The primary impact is a kernel WARNING splat, which can be used to flood system logs and potentially interfere with legitimate operations. While the warning itself does not directly corrupt memory, repeated exploitation could be part of a denial-of-service (DoS) strategy. The commit's note also suggests the zero-length behavior was historically accepted, so blindly rejecting such packets might break existing valid applications [1].

Mitigation

The fix introduces a length check in raw_sendmsg(): if the packet length is 0, the function returns early without calling __dev_queue_xmit(), thus preventing the WARNING. The patch has been applied to the stable kernel branches [1][2][3]. No workaround is needed after applying the update.