CVE-2022-50783

Root

Cause

The vulnerability resides in the Linux kernel's Multipath TCP (MPTCP) subsystem, specifically in the handling of connection request sockets for IPv6 subflows. Before the fix, the code universally invoked the TCP request sock destructor designed for IPv4 (via tcp_request_sock_ops) even when the underlying subflow was IPv6. This was incorrect because the IPv6 request socket (tcp6_request_sock) can embed additional fields—such as IPv6-specific options—that are allocated separately and require their own cleanup routine (tcp6_request_sock_ops). By calling the IPv4 destructor, these extra allocations were left unreleased, leading to memory leaks [1][2][3][4].

Exploitation

Prerequisites

The attack surface is local: an unprivileged user or a network-facing service on a system that uses MPTCP with IPv6 subflows can trigger the bug by establishing or accepting MPTCP connections over IPv6. No authentication is required beyond standard network access, and the flaw is reachable without special privileges if the system enables MPTCP (which is common in modern kernels). The bug is purely a kernel memory management error; it does not allow direct code injection or privilege escalation, but it can be repeatedly triggered to exhaust system memory.

Impact

An attacker who can initiate repeated MPTCP IPv6 connections can cause a gradual, sustained memory leak in the kernel. Over time, this can degrade system performance, exhaust available memory, and potentially lead to denial-of-service (system hang or crash). The leak does not corrupt data or provide arbitrary code execution, but it impacts availability. The official description confirms the fix is "important to avoid memory leaks with some advanced IPv6 features" [1].

Mitigation

The vulnerability is fixed in the upstream Linux kernel by commits that switch to using the proper per-protocol destructor based on the address family of the subflow. Users should apply the stable kernel updates containing these patches, which have been backported to multiple stable releases as indicated by the commit references [1][2][3][4]. No workarounds are documented other than updating the kernel.