sctp: handle the error returned from sctp_auth_asoc_init_active_key
Published Sep 15, 2025
7.8
HIGHCVSS 3.1
EPSS 0.16%
Description
When it returns an error from sctp_auth_asoc_init_active_key(), the active_key is actually not updated. The old sh_key will be freeed while it's still used as active key in asoc. Then an use-after-free will be triggered when sending patckets, as found by syzbot:
sctp_auth_shkey_hold+0x22/0xa0 net/sctp/auth.c:112 sctp_set_owner_w net/sctp/socket.c:132 [inline] sctp_sendmsg_to_asoc+0xbd5/0x1a20 net/sctp/socket.c:1863 sctp_sendmsg+0x1053/0x1d50 net/sctp/socket.c:2025 inet_sendmsg+0x99/0xe0 net/ipv4/af_inet.c:819 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:734
This patch is to fix it by not replacing the sh_key when it returns errors from sctp_auth_asoc_init_active_key() in sctp_auth_set_key(). For sctp_auth_set_active_key(), old active_key_id will be set back to asoc->active_key_id when the same thing happens.
Affected products
-
Affected
- ≥ 4.19.199, < 4.19.262
- ≥ 5.10.54, < 5.10.150
- ≥ 5.13.6, < 5.14
- ≥ 5.4.136, < 5.4.220
-
Affected
- ≥ , <
- ≥ , <
- ≥ , <
- ≥ , <
- ≥ , <
- ≥ , <
- ≥ , <
-
Affected
- 5.14
Unaffected
- ≥ 0, < 5.14
- ≥ 4.19.262, ≤ 4.19.*
- ≥ 5.10.150, ≤ 5.10.*
- ≥ 5.15.75, ≤ 5.15.*
- ≥ 5.19.17, ≤ 5.19.*
- ≥ 5.4.220, ≤ 5.4.*
- ≥ 6.0.3, ≤ 6.0.*
- 6.1
Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).
| Vendor | Product | Default status | Versions |
|---|---|---|---|
| Linux | Linux | unaffected | Affected
|
| Linux | Linux | unaffected | Affected
|
| Linux | Linux | affected | Affected
Unaffected
|
- ≥ 4.19.199 · < 4.19.262
- ≥ 5.4.136 · < 5.4.220
- ≥ 5.10.54 · < 5.10.150
- ≥ 5.13.6 · < 5.14
- ≥ 5.14.1 · < 5.15.75
- ≥ 5.16 · < 5.19.17
- ≥ 6.0 · < 6.0.3
- 5.14
- 5.14
- 5.14
- 5.14
- 5.14
- 5.14
No data.
Red Hat Enterprise Linux 8
kernel-0:4.18.0-477.10.1.el8_8
Fixed · RHSA-2023:2951
Red Hat Enterprise Linux 8.6 Extended Update Support
kernel-0:4.18.0-372.80.1.el8_6
Fixed · RHSA-2023:7398
Red Hat Enterprise Linux 9
kernel-0:5.14.0-284.11.1.el9_2
Fixed · RHSA-2023:2458
Red Hat Enterprise Linux 9
kernel-0:5.14.0-284.11.1.el9_2
Fixed · RHSA-2023:2458
Red Hat Virtualization 4 for Red Hat Enterprise Linux 8
kernel-0:4.18.0-372.80.1.el8_6
Fixed · RHSA-2023:7398
Red Hat Enterprise Linux 10
kernel
Not affected
Red Hat Enterprise Linux 6
kernel
Not affected
Red Hat Enterprise Linux 7
kernel
Not affected
Red Hat Enterprise Linux 7
kernel-rt
Not affected
Red Hat Enterprise Linux 8
kernel-rt
Fix deferred
Red Hat Enterprise Linux 9
kernel-rt
Fix deferred
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 8 | kernel-0:4.18.0-477.10.1.el8_8 | Fixed | RHSA-2023:2951 |
| Red Hat Enterprise Linux 8.6 Extended Update Support | kernel-0:4.18.0-372.80.1.el8_6 | Fixed | RHSA-2023:7398 |
| Red Hat Enterprise Linux 9 | kernel-0:5.14.0-284.11.1.el9_2 | Fixed | RHSA-2023:2458 |
| Red Hat Enterprise Linux 9 | kernel-0:5.14.0-284.11.1.el9_2 | Fixed | RHSA-2023:2458 |
| Red Hat Virtualization 4 for Red Hat Enterprise Linux 8 | kernel-0:4.18.0-372.80.1.el8_6 | Fixed | RHSA-2023:7398 |
| Red Hat Enterprise Linux 10 | kernel | Not affected | n/a |
| Red Hat Enterprise Linux 6 | kernel | Not affected | n/a |
| Red Hat Enterprise Linux 7 | kernel | Not affected | n/a |
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | n/a |
| Red Hat Enterprise Linux 8 | kernel-rt | Fix deferred | n/a |
| Red Hat Enterprise Linux 9 | kernel-rt | Fix deferred | n/a |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
References (13)
- https://access.redhat.com/security/cve/CVE-2022-50243 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2395428 Issue Tracking
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-55509 Advisory
- https://git.kernel.org/stable/c/022152aaebe116a25c39818a07e175a8cd3c1e11 Patch
- https://git.kernel.org/stable/c/0f90099d18e3abdc01babf686f41f63fe04939c1 Patch
- https://git.kernel.org/stable/c/19d636b663e0e92951bba5fced929ca7fd25c552 Patch
- https://git.kernel.org/stable/c/382ff44716603a54f5fd238ddec6a2468e217612 Patch
- https://git.kernel.org/stable/c/3b0fcf5e29c0940e1169ce9c44f73edd98bdf12d Patch
- https://git.kernel.org/stable/c/b8fa99a3a11bdd77fef6b4a97f1021eb30b5ba40 Patch
- https://git.kernel.org/stable/c/f65955340e0044f5c41ac799a01698ac7dee8a4e Patch
- https://lore.kernel.org/linux-cve-announce/2025091548-CVE-2022-50243-4311@gregkh/T
- https://nvd.nist.gov/vuln/detail/CVE-2022-50243
- https://www.cve.org/CVERecord?id=CVE-2022-50243
Change history (0)
No recorded changes yet.
CVE.org / MITRE
CISA Vulnrichment
No data
GitHub
No data