tcp: fix a signed-integer-overflow bug in tcp_add_backlog()
CVE: CVE-2022-50865
Component: kernel
CWE: CWE-190
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2022-01-01T00:00:00+00:00

A flaw was found in the Linux kernel’s TCP implementation in the function tcp_add_backlog(). When calculating the maximum acceptable backlog for TCP sockets, the sum of the receive buffer (sk_rcvbuf), the send buffer (sk_sndbuf), and a fixed constant may exceed the maximum value of a signed integer due to both buffer values being of type int. This can result in a signed integer overflow, potentially leading to incorrect backlog limits and unexpected TCP behavior under certain workloads.

Statement: A signed integer overflow in tcp_add_backlog() could occur when computing the backlog limit from sk_rcvbuf and sk_sndbuf, potentially resulting in an incorrect, reduced limit. A remote peer can trigger this condition by sending network traffic that stresses the TCP backlog, leading to premature packet drops and degraded service availability.
This issue is a typical network robustness bug, as the integer overflow only affects internal backlog limit calculations and can at most cause packet drops or limited service degradation (DoS), without providing a realistic path to host crashes, memory corruption, privilege escalation, or code execution.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.