CVE-2022-48906: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-48906 affects the Linux kernel's MPTCP (Multipath TCP) implementation. The vulnerability was discovered when Syzkaller with UBSAN uncovered a scenario where a large number of DATA_FIN retransmits caused a shift-out-of-bounds in the DATA_FIN timeout calculation. This issue affects Linux kernel versions from 5.12.4 up to versions before 5.15.27, from 5.16 to before 5.16.13, and 5.17-rc1 through 5.17-rc6 (NVD).

The vulnerability occurs in the mptcp_set_datafin_timeout function in net/mptcp/protocol.c. When calculating the DATA_FIN timeout, a shift operation with an exponent of 32 was attempted on a 32-bit unsigned integer type, leading to an out-of-bounds condition. The CVSS v3.1 Base Score is 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability could lead to a system crash or potential denial of service condition when processing MPTCP connections with a large number of DATA_FIN retransmits (NVD).

The vulnerability requires local access with low privileges and no user interaction. There are no known exploits actively targeting this vulnerability in the wild (NVD).

The issue has been fixed by limiting the maximum timeout through restricting the size of the shift operation, which keeps all intermediate values in-bounds. The fix was implemented through patches that modify the mptcp_set_datafin_timeout function to use a bounded retransmit value (Kernel Patch).