In the Linux kernel, the following vulnerability has been resolved:
tcp: fix a signed-integer-overflow bug in tcpaddbacklog()
The type of skrcvbuf and sksndbuf in struct sock is int, and in tcpaddbacklog(), the variable limit is caculated by adding skrcvbuf, sksndbuf and 64 * 1024, it may exceed the max value of int and overflow. This patch reduces the limit budget by halving the sndbuf to solve this issue since ACK packets are much smaller than the payload.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50865.json"
}