From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CDE7A1A314C for ; Wed, 26 Feb 2025 01:57:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740535070; cv=none; b=tOmpCNIL0of4NLlRz2Ue67SWIl3lTdO5Kk5Y9bdGR6gypZKX5Zhmh0sghPkhZyWrgN5WNB45LEZsoPP51vp+4MmpIijeKL19WFNz38/ki9SOGswHypbMrpMISqI+XpS9f1Ai+HUhPDqxEPGdGIWq6MJx8/PFFBqhFll/U1JgM+E= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740535070; c=relaxed/simple; bh=Z7Li4doG0PiMghLr9Gr85dr5zkeWPYUQgINOmszEuo0=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=cVcLHEz4+9tSqqTN4xR4Bbnp/D+hrd4h+eZmeyDsE1gffdlgsQ+wWt4UrI5KAODNWhfpzOp55RR/KC+Qc24IuWO8tq+kyjDYCG9e4vivyfV2QWBOySF1J96yHnRJ8NHybT0JKvUb+eB5nIxUTyfHgwaZnIfy5NP8NnSqBVqqbyY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=IrIuTogg; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="IrIuTogg" Received: by smtp.kernel.org (Postfix) with ESMTPSA id A29B8C4CEDD; Wed, 26 Feb 2025 01:57:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1740535070; bh=Z7Li4doG0PiMghLr9Gr85dr5zkeWPYUQgINOmszEuo0=; h=From:To:Cc:Subject:Date:Reply-to:From; b=IrIuToggD37Rp3Ah4lFsO+LwqU5utMWNdkj1BE4fp0tekrUobE3eapn5dJECY7KhW FXtVyPQJ4Uzi8XZZd0inUJmMUtnSysO63clMD8+fLPwl1lAMC1g4Rr8z+b9EEOabgI 06rViuH7Msx7VlzXoHmbl5QR71dbFGyC4zthR77k= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2022-49066: veth: Ensure eth header is in skb's linear part Date: Wed, 26 Feb 2025 02:54:31 +0100 Message-ID: <2025022654-CVE-2022-49066-bc68@gregkh> X-Mailer: git-send-email 2.48.1 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=4466; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=Z7Li4doG0PiMghLr9Gr85dr5zkeWPYUQgINOmszEuo0=; b=owGbwMvMwCRo6H6F97bub03G02pJDOn7Soyc7rfU1xb8eP++PWFREpfT281Rm812FDod33HlZ odG82GHjlgWBkEmBlkxRZYv23iO7q84pOhlaHsaZg4rE8gQBi5OAZhIYAzD/PJTXT9POUps+N4n vltpQi/DqWVGnAwLrnZ6znu0OkZi34ETD/VeON7W3+TzGAA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: veth: Ensure eth header is in skb's linear part After feeding a decapsulated packet to a veth device with act_mirred, skb_headlen() may be 0. But veth_xmit() calls __dev_forward_skb(), which expects at least ETH_HLEN byte of linear data (as __dev_forward_skb2() calls eth_type_trans(), which pulls ETH_HLEN bytes unconditionally). Use pskb_may_pull() to ensure veth_xmit() respects this constraint. kernel BUG at include/linux/skbuff.h:2328! RIP: 0010:eth_type_trans+0xcf/0x140 Call Trace: __dev_forward_skb2+0xe3/0x160 veth_xmit+0x6e/0x250 [veth] dev_hard_start_xmit+0xc7/0x200 __dev_queue_xmit+0x47f/0x520 ? skb_ensure_writable+0x85/0xa0 ? skb_mpls_pop+0x98/0x1c0 tcf_mirred_act+0x442/0x47e [act_mirred] tcf_action_exec+0x86/0x140 fl_classify+0x1d8/0x1e0 [cls_flower] ? dma_pte_clear_level+0x129/0x1a0 ? dma_pte_clear_level+0x129/0x1a0 ? prb_fill_curr_block+0x2f/0xc0 ? skb_copy_bits+0x11a/0x220 __tcf_classify+0x58/0x110 tcf_classify_ingress+0x6b/0x140 __netif_receive_skb_core.constprop.0+0x47d/0xfd0 ? __iommu_dma_unmap_swiotlb+0x44/0x90 __netif_receive_skb_one_core+0x3d/0xa0 netif_receive_skb+0x116/0x170 be_process_rx+0x22f/0x330 [be2net] be_poll+0x13c/0x370 [be2net] __napi_poll+0x2a/0x170 net_rx_action+0x22f/0x2f0 __do_softirq+0xca/0x2a8 __irq_exit_rcu+0xc1/0xe0 common_interrupt+0x83/0xa0 The Linux kernel CVE team has assigned CVE-2022-49066 to this issue. Affected and fixed versions =========================== Issue introduced in 2.6.24 with commit e314dbdc1c0dc6a548ecf0afce28ecfd538ff568 and fixed in 4.9.311 with commit 3de2a02b60a4ef0ab76263216f08c7d095fc7c42 Issue introduced in 2.6.24 with commit e314dbdc1c0dc6a548ecf0afce28ecfd538ff568 and fixed in 4.14.276 with commit d417a859221f127e8edf09c14b76ab50f825e171 Issue introduced in 2.6.24 with commit e314dbdc1c0dc6a548ecf0afce28ecfd538ff568 and fixed in 4.19.239 with commit 1ef0088e43af1de4e3b365218c4d3179d9a37eec Issue introduced in 2.6.24 with commit e314dbdc1c0dc6a548ecf0afce28ecfd538ff568 and fixed in 5.4.190 with commit 2fd90b86dff413fbf8128780c04ea9c6849c16e2 Issue introduced in 2.6.24 with commit e314dbdc1c0dc6a548ecf0afce28ecfd538ff568 and fixed in 5.10.112 with commit d67c900f1947d64ba8a64f693504bcaab8d9000c Issue introduced in 2.6.24 with commit e314dbdc1c0dc6a548ecf0afce28ecfd538ff568 and fixed in 5.15.35 with commit 93940fc4cb81840dc0fa202de48cccb949a0261d Issue introduced in 2.6.24 with commit e314dbdc1c0dc6a548ecf0afce28ecfd538ff568 and fixed in 5.17.4 with commit 46bc359fec0c6d87b70d7a008bcd9a5e30dd6f27 Issue introduced in 2.6.24 with commit e314dbdc1c0dc6a548ecf0afce28ecfd538ff568 and fixed in 5.18 with commit 726e2c5929de841fdcef4e2bf995680688ae1b87 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2022-49066 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/net/veth.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/3de2a02b60a4ef0ab76263216f08c7d095fc7c42 https://git.kernel.org/stable/c/d417a859221f127e8edf09c14b76ab50f825e171 https://git.kernel.org/stable/c/1ef0088e43af1de4e3b365218c4d3179d9a37eec https://git.kernel.org/stable/c/2fd90b86dff413fbf8128780c04ea9c6849c16e2 https://git.kernel.org/stable/c/d67c900f1947d64ba8a64f693504bcaab8d9000c https://git.kernel.org/stable/c/93940fc4cb81840dc0fa202de48cccb949a0261d https://git.kernel.org/stable/c/46bc359fec0c6d87b70d7a008bcd9a5e30dd6f27 https://git.kernel.org/stable/c/726e2c5929de841fdcef4e2bf995680688ae1b87