CVE-2022-49204: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49204 affects the Linux kernel's BPF sockmap implementation. The vulnerability was discovered in the tcp_bpf_send_verdict() function where a message size accounting issue occurs when handling data after tcp_bpf_sendmsg_redir(). The issue results in memory being uncharged twice from sk->sk_forward_alloc, potentially leading to memory accounting inconsistencies (Kernel Commit).

The vulnerability occurs in the tcp_bpf_send_verdict() function when a message has more data after tcp_bpf_sendmsg_redir(). Specifically, when msg->sg.size is initially 22220 bytes, after tcp_bpf_sendmsg_redir() it becomes 11000 bytes. The msg->sg.size gets uncharged twice from sk->sk_forward_alloc - once during the initial sk_msg_return() call and again after the more_data handling (Kernel Commit).

This vulnerability can trigger kernel warnings and potentially lead to memory accounting inconsistencies. The issue manifests through warnings in sk_stream_kill_queues and inet_sock_destruct functions, indicating potential memory management issues that could affect system stability (Kernel Commit).

The vulnerability requires access to the BPF sockmap functionality and can be triggered through specific message handling sequences in tcp_bpf_send_verdict(). While no public exploits are known, the issue could potentially be leveraged to cause system instability (Kernel Commit).

The issue has been fixed by properly charging the remaining msg->sg.size before goto more_data in the tcp_bpf_send_verdict() function. The fix involves modifying the sk_msg_return() call to use msg->sg.size instead of tosend, and adding an explicit sk_mem_charge() call when eval equals __SK_REDIRECT (Kernel Commit).