linux-cve-announce - CVE-2022-49066: veth: Ensure eth header is in skb's linear part

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025022654-CVE-2022-49066-bc68@gregkh>
Date: Wed, 26 Feb 2025 02:54:31 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2022-49066: veth: Ensure eth header is in skb's linear part

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

veth: Ensure eth header is in skb's linear part

After feeding a decapsulated packet to a veth device with act_mirred,
skb_headlen() may be 0. But veth_xmit() calls __dev_forward_skb(),
which expects at least ETH_HLEN byte of linear data (as
__dev_forward_skb2() calls eth_type_trans(), which pulls ETH_HLEN bytes
unconditionally).

Use pskb_may_pull() to ensure veth_xmit() respects this constraint.

kernel BUG at include/linux/skbuff.h:2328!
RIP: 0010:eth_type_trans+0xcf/0x140
Call Trace:
 <IRQ>
 __dev_forward_skb2+0xe3/0x160
 veth_xmit+0x6e/0x250 [veth]
 dev_hard_start_xmit+0xc7/0x200
 __dev_queue_xmit+0x47f/0x520
 ? skb_ensure_writable+0x85/0xa0
 ? skb_mpls_pop+0x98/0x1c0
 tcf_mirred_act+0x442/0x47e [act_mirred]
 tcf_action_exec+0x86/0x140
 fl_classify+0x1d8/0x1e0 [cls_flower]
 ? dma_pte_clear_level+0x129/0x1a0
 ? dma_pte_clear_level+0x129/0x1a0
 ? prb_fill_curr_block+0x2f/0xc0
 ? skb_copy_bits+0x11a/0x220
 __tcf_classify+0x58/0x110
 tcf_classify_ingress+0x6b/0x140
 __netif_receive_skb_core.constprop.0+0x47d/0xfd0
 ? __iommu_dma_unmap_swiotlb+0x44/0x90
 __netif_receive_skb_one_core+0x3d/0xa0
 netif_receive_skb+0x116/0x170
 be_process_rx+0x22f/0x330 [be2net]
 be_poll+0x13c/0x370 [be2net]
 __napi_poll+0x2a/0x170
 net_rx_action+0x22f/0x2f0
 __do_softirq+0xca/0x2a8
 __irq_exit_rcu+0xc1/0xe0
 common_interrupt+0x83/0xa0

The Linux kernel CVE team has assigned CVE-2022-49066 to this issue.

Affected and fixed versions
===========================

	Issue introduced in 2.6.24 with commit e314dbdc1c0dc6a548ecf0afce28ecfd538ff568 and fixed in 4.9.311 with commit 3de2a02b60a4ef0ab76263216f08c7d095fc7c42
	Issue introduced in 2.6.24 with commit e314dbdc1c0dc6a548ecf0afce28ecfd538ff568 and fixed in 4.14.276 with commit d417a859221f127e8edf09c14b76ab50f825e171
	Issue introduced in 2.6.24 with commit e314dbdc1c0dc6a548ecf0afce28ecfd538ff568 and fixed in 4.19.239 with commit 1ef0088e43af1de4e3b365218c4d3179d9a37eec
	Issue introduced in 2.6.24 with commit e314dbdc1c0dc6a548ecf0afce28ecfd538ff568 and fixed in 5.4.190 with commit 2fd90b86dff413fbf8128780c04ea9c6849c16e2
	Issue introduced in 2.6.24 with commit e314dbdc1c0dc6a548ecf0afce28ecfd538ff568 and fixed in 5.10.112 with commit d67c900f1947d64ba8a64f693504bcaab8d9000c
	Issue introduced in 2.6.24 with commit e314dbdc1c0dc6a548ecf0afce28ecfd538ff568 and fixed in 5.15.35 with commit 93940fc4cb81840dc0fa202de48cccb949a0261d
	Issue introduced in 2.6.24 with commit e314dbdc1c0dc6a548ecf0afce28ecfd538ff568 and fixed in 5.17.4 with commit 46bc359fec0c6d87b70d7a008bcd9a5e30dd6f27
	Issue introduced in 2.6.24 with commit e314dbdc1c0dc6a548ecf0afce28ecfd538ff568 and fixed in 5.18 with commit 726e2c5929de841fdcef4e2bf995680688ae1b87

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-49066
will be updated if fixes are backported, please check that for the most
up to date information about this issue.

Affected files
==============

The file(s) affected by this issue are:
	drivers/net/veth.c

Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/3de2a02b60a4ef0ab76263216f08c7d095fc7c42
	https://git.kernel.org/stable/c/d417a859221f127e8edf09c14b76ab50f825e171
	https://git.kernel.org/stable/c/1ef0088e43af1de4e3b365218c4d3179d9a37eec
	https://git.kernel.org/stable/c/2fd90b86dff413fbf8128780c04ea9c6849c16e2
	https://git.kernel.org/stable/c/d67c900f1947d64ba8a64f693504bcaab8d9000c
	https://git.kernel.org/stable/c/93940fc4cb81840dc0fa202de48cccb949a0261d
	https://git.kernel.org/stable/c/46bc359fec0c6d87b70d7a008bcd9a5e30dd6f27
	https://git.kernel.org/stable/c/726e2c5929de841fdcef4e2bf995680688ae1b87