CVE-2022-49340 (GCVE-0-2022-49340)
Vulnerability from cvelistv5
Published
2025-02-26 02:10
Modified
2025-05-04 12:44
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: ip_gre: test csum_start instead of transport header GRE with TUNNEL_CSUM will apply local checksum offload on CHECKSUM_PARTIAL packets. ipgre_xmit must validate csum_start after an optional skb_pull, else lco_csum may trigger an overflow. The original check was if (csum && skb_checksum_start(skb) < skb->data) return -EINVAL; This had false positives when skb_checksum_start is undefined: when ip_summed is not CHECKSUM_PARTIAL. A discussed refinement was straightforward if (csum && skb->ip_summed == CHECKSUM_PARTIAL && skb_checksum_start(skb) < skb->data) return -EINVAL; But was eventually revised more thoroughly: - restrict the check to the only branch where needed, in an uncommon GRE path that uses header_ops and calls skb_pull. - test skb_transport_header, which is set along with csum_start in skb_partial_csum_set in the normal header_ops datapath. Turns out skbs can arrive in this branch without the transport header set, e.g., through BPF redirection. Revise the check back to check csum_start directly, and only if CHECKSUM_PARTIAL. Do leave the check in the updated location. Check field regardless of whether TUNNEL_CSUM is configured.
References
Impacted products
Vendor Product Version
Linux Linux Version: 774430026bd9a472d08c5d3c33351a782315771a
Version: 3d32ce5472bb2ca720bef84089b85f76a705fd1a
Version: 87b34cd6485192777f632f92d592f2a71d8801a6
Version: 8a0ed250f911da31a2aef52101bc707846a800ff
Version: 8a0ed250f911da31a2aef52101bc707846a800ff
Version: 8a0ed250f911da31a2aef52101bc707846a800ff
Version: 8a0ed250f911da31a2aef52101bc707846a800ff
Version: 4bf5d5224ffca069df4501ba5fcc6ded9c002ead
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/ip_gre.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7596bd7920985f7fc8579a92e48bc53ce4475b21",
              "status": "affected",
              "version": "774430026bd9a472d08c5d3c33351a782315771a",
              "versionType": "git"
            },
            {
              "lessThan": "3d08bc3a5d9b2106f5c8bcf1adb73147824aa006",
              "status": "affected",
              "version": "3d32ce5472bb2ca720bef84089b85f76a705fd1a",
              "versionType": "git"
            },
            {
              "lessThan": "fbeb8dfa8b87ef259eef0c89e39b53962a3cf604",
              "status": "affected",
              "version": "87b34cd6485192777f632f92d592f2a71d8801a6",
              "versionType": "git"
            },
            {
              "lessThan": "e6b6f98fc7605c06c0a3baa70f62c534d7b4ce58",
              "status": "affected",
              "version": "8a0ed250f911da31a2aef52101bc707846a800ff",
              "versionType": "git"
            },
            {
              "lessThan": "0c92d813c7c9ca2212ecd879232e7d87362fce98",
              "status": "affected",
              "version": "8a0ed250f911da31a2aef52101bc707846a800ff",
              "versionType": "git"
            },
            {
              "lessThan": "0ffa268724656633af5f37a38c212326d98ebe8c",
              "status": "affected",
              "version": "8a0ed250f911da31a2aef52101bc707846a800ff",
              "versionType": "git"
            },
            {
              "lessThan": "8d21e9963bec1aad2280cdd034c8993033ef2948",
              "status": "affected",
              "version": "8a0ed250f911da31a2aef52101bc707846a800ff",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4bf5d5224ffca069df4501ba5fcc6ded9c002ead",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/ip_gre.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.247",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.198",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.122",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.47",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.15",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.247",
                  "versionStartIncluding": "4.19.207",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.198",
                  "versionStartIncluding": "5.4.148",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.122",
                  "versionStartIncluding": "5.10.68",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.47",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.15",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.4",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.14.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nip_gre: test csum_start instead of transport header\n\nGRE with TUNNEL_CSUM will apply local checksum offload on\nCHECKSUM_PARTIAL packets.\n\nipgre_xmit must validate csum_start after an optional skb_pull,\nelse lco_csum may trigger an overflow. The original check was\n\n\tif (csum \u0026\u0026 skb_checksum_start(skb) \u003c skb-\u003edata)\n\t\treturn -EINVAL;\n\nThis had false positives when skb_checksum_start is undefined:\nwhen ip_summed is not CHECKSUM_PARTIAL. A discussed refinement\nwas straightforward\n\n\tif (csum \u0026\u0026 skb-\u003eip_summed == CHECKSUM_PARTIAL \u0026\u0026\n\t    skb_checksum_start(skb) \u003c skb-\u003edata)\n\t\treturn -EINVAL;\n\nBut was eventually revised more thoroughly:\n- restrict the check to the only branch where needed, in an\n  uncommon GRE path that uses header_ops and calls skb_pull.\n- test skb_transport_header, which is set along with csum_start\n  in skb_partial_csum_set in the normal header_ops datapath.\n\nTurns out skbs can arrive in this branch without the transport\nheader set, e.g., through BPF redirection.\n\nRevise the check back to check csum_start directly, and only if\nCHECKSUM_PARTIAL. Do leave the check in the updated location.\nCheck field regardless of whether TUNNEL_CSUM is configured."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T12:44:28.114Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7596bd7920985f7fc8579a92e48bc53ce4475b21"
        },
        {
          "url": "https://git.kernel.org/stable/c/3d08bc3a5d9b2106f5c8bcf1adb73147824aa006"
        },
        {
          "url": "https://git.kernel.org/stable/c/fbeb8dfa8b87ef259eef0c89e39b53962a3cf604"
        },
        {
          "url": "https://git.kernel.org/stable/c/e6b6f98fc7605c06c0a3baa70f62c534d7b4ce58"
        },
        {
          "url": "https://git.kernel.org/stable/c/0c92d813c7c9ca2212ecd879232e7d87362fce98"
        },
        {
          "url": "https://git.kernel.org/stable/c/0ffa268724656633af5f37a38c212326d98ebe8c"
        },
        {
          "url": "https://git.kernel.org/stable/c/8d21e9963bec1aad2280cdd034c8993033ef2948"
        }
      ],
      "title": "ip_gre: test csum_start instead of transport header",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49340",
    "datePublished": "2025-02-26T02:10:57.322Z",
    "dateReserved": "2025-02-26T02:08:31.541Z",
    "dateUpdated": "2025-05-04T12:44:28.114Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49340\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-26T07:01:10.753\",\"lastModified\":\"2025-02-26T07:01:10.753\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nip_gre: test csum_start instead of transport header\\n\\nGRE with TUNNEL_CSUM will apply local checksum offload on\\nCHECKSUM_PARTIAL packets.\\n\\nipgre_xmit must validate csum_start after an optional skb_pull,\\nelse lco_csum may trigger an overflow. The original check was\\n\\n\\tif (csum \u0026\u0026 skb_checksum_start(skb) \u003c skb-\u003edata)\\n\\t\\treturn -EINVAL;\\n\\nThis had false positives when skb_checksum_start is undefined:\\nwhen ip_summed is not CHECKSUM_PARTIAL. A discussed refinement\\nwas straightforward\\n\\n\\tif (csum \u0026\u0026 skb-\u003eip_summed == CHECKSUM_PARTIAL \u0026\u0026\\n\\t    skb_checksum_start(skb) \u003c skb-\u003edata)\\n\\t\\treturn -EINVAL;\\n\\nBut was eventually revised more thoroughly:\\n- restrict the check to the only branch where needed, in an\\n  uncommon GRE path that uses header_ops and calls skb_pull.\\n- test skb_transport_header, which is set along with csum_start\\n  in skb_partial_csum_set in the normal header_ops datapath.\\n\\nTurns out skbs can arrive in this branch without the transport\\nheader set, e.g., through BPF redirection.\\n\\nRevise the check back to check csum_start directly, and only if\\nCHECKSUM_PARTIAL. Do leave the check in the updated location.\\nCheck field regardless of whether TUNNEL_CSUM is configured.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ip_gre: prueba csum_start en lugar del encabezado de transporte GRE con TUNNEL_CSUM aplicar\u00e1 la descarga de suma de comprobaci\u00f3n local en los paquetes CHECKSUM_PARTIAL. ipgre_xmit debe validar csum_start despu\u00e9s de un skb_pull opcional, de lo contrario lco_csum puede provocar un desbordamiento. La comprobaci\u00f3n original era if (csum \u0026amp;\u0026amp; skb_checksum_start(skb) \u0026lt; skb-\u0026gt;data) return -EINVAL; Esto ten\u00eda falsos positivos cuando skb_checksum_start no est\u00e1 definido: cuando ip_summed no es CHECKSUM_PARTIAL. Una mejora discutida fue sencilla if (csum \u0026amp;\u0026amp; skb-\u0026gt;ip_summed == CHECKSUM_PARTIAL \u0026amp;\u0026amp; skb_checksum_start(skb) \u0026lt; skb-\u0026gt;data) return -EINVAL; Pero finalmente se revis\u00f3 m\u00e1s a fondo: - restringir la verificaci\u00f3n a la \u00fanica rama donde sea necesario, en una ruta GRE poco com\u00fan que usa header_ops y llama a skb_pull. - probar skb_transport_header, que se establece junto con csum_start en skb_partial_csum_set en la ruta de datos header_ops normal. Resulta que skbs puede llegar a esta rama sin el encabezado de transporte establecido, por ejemplo, a trav\u00e9s de la redirecci\u00f3n BPF. Revise la verificaci\u00f3n nuevamente para verificar csum_start directamente, y solo si CHECKSUM_PARTIAL. Deje la verificaci\u00f3n en la ubicaci\u00f3n actualizada. Verifique el campo independientemente de si TUNNEL_CSUM est\u00e1 configurado.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0c92d813c7c9ca2212ecd879232e7d87362fce98\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/0ffa268724656633af5f37a38c212326d98ebe8c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3d08bc3a5d9b2106f5c8bcf1adb73147824aa006\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7596bd7920985f7fc8579a92e48bc53ce4475b21\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8d21e9963bec1aad2280cdd034c8993033ef2948\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e6b6f98fc7605c06c0a3baa70f62c534d7b4ce58\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fbeb8dfa8b87ef259eef0c89e39b53962a3cf604\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.