CVE-2022-49013

What it actually does

The vulnerability causes a memory leak in the SCTP stream output queue migration function, where allocated memory for priority head structures is not freed when releasing stream resources.

Why it matters to the business

Systems using SCTP may experience gradual memory exhaustion, potentially leading to degraded performance or system instability if the leak is triggered repeatedly.

How an attack unfolds

An attacker can trigger the memory leak by initiating SCTP connections and performing operations that call sctp_stream_outq_migrate(), causing unreleased memory allocations over time.

How to fix it

Update the Linux kernel to the fixed commit a7555681e50bdebed2c40ff7404ee73c2e932993 or later stable versions containing the patch for sctp_stream_outq_migrate().

How to confirm the fix worked

Verify the running kernel includes commit a7555681e50bdebed2c40ff7404ee73c2e932993 and use kmemleak or similar tools to confirm no unreferenced SCTP priority objects remain after stream operations.

Typical attack path

1. Establish an SCTP association with the target
2. Send crafted messages that trigger stream initialization and priority scheduling
3. Invoke stream migration to release resources without freeing prio_head memory
4. Repeat operations to accumulate leaked allocations leading to exhaustion

How to detect it

Enable kernel memory leak detection and inspect for unreferenced objects allocated during SCTP sendmsg and stream init paths; review process activity involving sctp_sendmsg.

What your security team should do

• Apply the kernel update containing the referenced fix as soon as possible
• Monitor memory usage on SCTP-enabled systems for unexpected growth
• Limit exposure by disabling SCTP where not required
• Test patched kernels in a staging environment before production deployment