CVE-2022-49017

What it actually does

Use-after-free in tipc_crypto_rcv_complete after tipc_msg_validate frees the original skb, causing dereference of the stale skb control block pointer and kernel crash via KASAN-detected invalid memory access.

Why it matters to the business

Denial of service via kernel panic on systems using the TIPC protocol; exposure to espionage and financially motivated actors in 2024 zero-day campaigns increases urgency for kernel updates despite low EPSS and no KEV listing.

How an attack unfolds

An attacker sends specially crafted TIPC messages that cause tipc_msg_validate to free the skb during receive processing; the calling path in tipc_crypto_rcv_complete then accesses the freed skb cb, enabling crash or potential memory corruption exploitation by actors in listed 2024 campaigns.

How to fix it

Apply the upstream kernel fix that re-fetches the skb cb after tipc_msg_validate; for gitlab-org/gitlab update to commit 84cf95d60d2691201b17bb4d41a95987ded847fb.

How to confirm the fix worked

Confirm the re-fetch of skb cb pointer occurs immediately after the tipc_msg_validate call in tipc_crypto_rcv_complete; test with TIPC message flows that previously triggered the free-and-dereference sequence.

Typical attack path

1. Craft and transmit malicious TIPC protocol message to trigger receive path
2. Invoke tipc_msg_validate which frees the skb buffer
3. Continue execution in tipc_crypto_rcv_complete using dangling skb cb pointer
4. Trigger KASAN use-after-free or kernel panic for DoS or further corruption

How to detect it

Inspect kernel logs for KASAN use-after-free reports referencing tipc_crypto_rcv_complete and tipc_msg_validate; correlate with unusual TIPC traffic patterns or skb allocation/free sequences from the listed call traces.

• BUG: KASAN: use-after-free in tipc_crypto_rcv_complete
• tipc_msg_validate+0x7b/0x440
• tipc_crypto_rcv_complete+0x4b5/0x2240

What your security team should do

• Prioritize kernel updates on all systems exposing TIPC protocol within the next 30 days given 2024 zero-day actor interest
• Disable TIPC module if not required to reduce attack surface
• Monitor for TIPC-related kernel oops or KASAN reports in system logs
• Apply the exact gitlab-org/gitlab commit 84cf95d60d2691201b17bb4d41a95987ded847fb where applicable