From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B65BC1A5B8A for ; Wed, 26 Feb 2025 01:58:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740535088; cv=none; b=CfXXi52GujrFTY7hk/N2ZP+YB+CxK/OO+XMC8klp9ZgDKAmTces5cSB9SnHOeLPT8NlLV+dAwS02y/QROk/DH5wZKCnwjM/Tl1ZDlbbI9XryegV1R845dle6BTX+mFrKRxZLFbMQ1RfMP2ap9Q1D3EzYjS8BRjvR4wWU0jkPOBA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740535088; c=relaxed/simple; bh=z7AMi2wesnWkEZnH1Mj2k8zsq5HwE2AK7wBq33eWhxk=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=FLujAwWclvj+YWZPoD1AVACEWhd6JtwQkjb8iyycDBAB5s9aBLGmo24h0QLGQ3EoY7YWpNZ6MCOZREud6HGegcUBCdh73dzdOkCBYVq6hWcjTHJJ/FPYsp7sOmej7ZZrQZlo3034+BvgEsL7gnZRjqYjnFESBj67nT0dePcupH8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=1YZCxvOE; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="1YZCxvOE" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8BD3BC4CEDD; Wed, 26 Feb 2025 01:58:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1740535088; bh=z7AMi2wesnWkEZnH1Mj2k8zsq5HwE2AK7wBq33eWhxk=; h=From:To:Cc:Subject:Date:Reply-to:From; b=1YZCxvOErgTOnR11s7NgcYg4syjzsSCtOHvgSx2qJOt45jXQmOfOAKxhStfyHN4BH uph6VKUSycLTL7uYRJoNfmF026+5UxDT1YNEPSXJHKtlToTt5vov8T3wzjcL95UmK5 aEViIhAtRaqBlTuUapy1C606svehydwMVdldYgUA= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2022-49092: net: ipv4: fix route with nexthop object delete warning Date: Wed, 26 Feb 2025 02:54:57 +0100 Message-ID: <2025022658-CVE-2022-49092-db38@gregkh> X-Mailer: git-send-email 2.48.1 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=8654; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=nLhOiMzCCo6RRitMq0lkVeXYAGGWFhcSnEc6u26PC5o=; b=owGbwMvMwCRo6H6F97bub03G02pJDOn7SsyZTWq6jlh2pXTMtRI71fxor7Zt59W0d8q9iy71S lxIiljZEcvCIMjEICumyPJlG8/R/RWHFL0MbU/DzGFlAhnCwMUpABPJ0GWYX1NauKb1wZIyiXrR mXsEFgildBYYMsxP653LzKrw1UE293vJ5w1zIgpY33sDAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: quoted-printable Description =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D In the Linux kernel, the following vulnerability has been resolved: net: ipv4: fix route with nexthop object delete warning FRR folks have hit a kernel warning[1] while deleting routes[2] which is caused by trying to delete a route pointing to a nexthop id without specifying nhid but matching on an interface. That is, a route is found but we hit a warning while matching it. The warning is from fib_info_nh() in include/net/nexthop.h because we run it on a fib_info with nexthop object. The call chain is: inet_rtm_delroute -> fib_table_delete -> fib_nh_match (called with a nexthop fib_info and also with fc_oif set thus calling fib_info_nh on the fib_info and triggering the warning). The fix is to not do any matching in that branch if the fi has a nexthop object because those are managed separately. I.e. we should match when deleting without nh spec and should fail when deleting a nexthop route with old-style nh spec because nexthop objects are managed separately, e.g.: $ ip r show 1.2.3.4/32 1.2.3.4 nhid 12 via 192.168.11.2 dev dummy0 $ ip r del 1.2.3.4/32 $ ip r del 1.2.3.4/32 nhid 12 $ ip r del 1.2.3.4/32 dev dummy0 [1] [ 523.462226] ------------[ cut here ]------------ [ 523.462230] WARNING: CPU: 14 PID: 22893 at include/net/nexthop.h:468 fi= b_nh_match+0x210/0x460 [ 523.462236] Modules linked in: dummy rpcsec_gss_krb5 xt_socket nf_socke= t_ipv4 nf_socket_ipv6 ip6table_raw iptable_raw bpf_preload xt_statistic ip_= set ip_vs_sh ip_vs_wrr ip_vs_rr ip_vs xt_mark nf_tables xt_nat veth nf_conn= track_netlink nfnetlink xt_addrtype br_netfilter overlay dm_crypt nfsv3 nfs= fscache netfs vhost_net vhost vhost_iotlb tap tun xt_CHECKSUM xt_MASQUERAD= E xt_conntrack 8021q garp mrp ipt_REJECT nf_reject_ipv4 ip6table_mangle ip6= table_nat iptable_mangle iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_= defrag_ipv4 iptable_filter bridge stp llc rfcomm snd_seq_dummy snd_hrtimer = rpcrdma rdma_cm iw_cm ib_cm ib_core ip6table_filter xt_comment ip6_tables v= boxnetadp(OE) vboxnetflt(OE) vboxdrv(OE) qrtr bnep binfmt_misc xfs vfat fat= squashfs loop nvidia_drm(POE) nvidia_modeset(POE) nvidia_uvm(POE) nvidia(P= OE) intel_rapl_msr intel_rapl_common snd_hda_codec_realtek snd_hda_codec_ge= neric ledtrig_audio snd_hda_codec_hdmi btusb btrtl iwlmvm uvcvideo btbcm sn= d_hda_intel edac_mce_amd [ 523.462274] videobuf2_vmalloc videobuf2_memops btintel snd_intel_dspcf= g videobuf2_v4l2 snd_intel_sdw_acpi bluetooth snd_usb_audio snd_hda_codec m= ac80211 snd_usbmidi_lib joydev snd_hda_core videobuf2_common kvm_amd snd_ra= wmidi snd_hwdep snd_seq videodev ccp snd_seq_device libarc4 ecdh_generic mc= snd_pcm kvm iwlwifi snd_timer drm_kms_helper snd cfg80211 cec soundcore ir= qbypass rapl wmi_bmof i2c_piix4 rfkill k10temp pcspkr acpi_cpufreq nfsd aut= h_rpcgss nfs_acl lockd grace sunrpc drm zram ip_tables crct10dif_pclmul crc= 32_pclmul crc32c_intel ghash_clmulni_intel nvme sp5100_tco r8169 nvme_core = wmi ipmi_devintf ipmi_msghandler fuse [ 523.462300] CPU: 14 PID: 22893 Comm: ip Tainted: P OE 5.1= 6.18-200.fc35.x86_64 #1 [ 523.462302] Hardware name: Micro-Star International Co., Ltd. MS-7C37/M= PG X570 GAMING EDGE WIFI (MS-7C37), BIOS 1.C0 10/29/2020 [ 523.462303] RIP: 0010:fib_nh_match+0x210/0x460 [ 523.462304] Code: 7c 24 20 48 8b b5 90 00 00 00 e8 bb ee f4 ff 48 8b 7c= 24 20 41 89 c4 e8 ee eb f4 ff 45 85 e4 0f 85 2e fe ff ff e9 4c ff ff ff <0= f> 0b e9 17 ff ff ff 3c 0a 0f 85 61 fe ff ff 48 8b b5 98 00 00 00 [ 523.462306] RSP: 0018:ffffaa53d4d87928 EFLAGS: 00010286 [ 523.462307] RAX: 0000000000000000 RBX: ffffaa53d4d87a90 RCX: ffffaa53d4= d87bb0 [ 523.462308] RDX: ffff9e3d2ee6be80 RSI: ffffaa53d4d87a90 RDI: ffffffff92= 0ed380 [ 523.462309] RBP: ffff9e3d2ee6be80 R08: 0000000000000064 R09: 0000000000= 000000 [ 523.462310] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000= 000031 [ 523.462310] R13: 0000000000000020 R14: 0000000000000000 R15: ffff9e3d33= 1054e0 [ 523.462311] FS: 00007f245517c1c0(0000) GS:ffff9e492ed80000(0000) knlGS= :0000000000000000 [ 523.462313] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 523.462313] CR2: 000055e5dfdd8268 CR3: 00000003ef488000 CR4: 0000000000= 350ee0 [ 523.462315] Call Trace: [ 523.462316] [ 523.462320] fib_table_delete+0x1a9/0x310 [ 523.462323] inet_rtm_delroute+0x93/0x110 [ 523.462325] rtnetlink_rcv_msg+0x133/0x370 [ 523.462327] ? _copy_to_iter+0xb5/0x6f0 [ 523.462330] ? rtnl_calcit.isra.0+0x110/0x110 [ 523.462331] netlink_rcv_skb+0x50/0xf0 [ 523.462334] netlink_unicast+0x211/0x330 [ 523.462336] netlink_sendmsg+0x23f/0x480 [ 523.462338] sock_sendmsg+0x5e/0x60 [ 523.462340] ____sys_sendmsg+0x22c/0x270 [ 523.462341] ? import_iovec+0x17/0x20 [ 523.462343] ? sendmsg_copy_msghdr+0x59/0x90 [ 523.462344] ? __mod_lruvec_page_state+0x85/0x110 [ 523.462348] ___sys_sendmsg+0x81/0xc0 [ 523.462350] ? netlink_seq_start+0x70/0x70 [ 523.462352] ? __dentry_kill+0x13a/0x180 [ 523.462354] ? __fput+0xff/0x250 [ 523.462356] __sys_sendmsg+0x49/0x80 [ 523.462358] do_syscall_64+0x3b/0x90 [ 523.462361] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 523.462364] RIP: 0033:0x7f24552aa337 [ 523.462365] Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f= 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <4= 8> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 [ 523.462366] RSP: 002b:00007fff7f05a838 EFLAGS: 00000246 ORIG_RAX: 00000= 0000000002e [ 523.462368] RAX: ffffffffffffffda RBX: 000000006245bf91 RCX: 00007f2455= 2aa337 [ 523.462368] RDX: 0000000000000000 RSI: 00007fff7f05a8a0 RDI: 0000000000= 000003 [ 523.462369] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000= 000000 [ 523.462370] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000= 000001 [ 523.462370] R13: 00007fff7f05ce08 R14: 0000000000000000 R15: 000055e5df= dd1040 [ 523.462373] [ 523.462374] ---[ end trace ba537bc16f6bf4ed ]--- [2] https://github.com/FRRouting/frr/issues/6412 The Linux kernel CVE team has assigned CVE-2022-49092 to this issue. Affected and fixed versions =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D Issue introduced in 5.3 with commit 4c7e8084fd467ddb2b0e6c6011f9c1064afb7e= 56 and fixed in 5.4.189 with commit f5064531c23ad646da7be8b938292b00a7e61438 Issue introduced in 5.3 with commit 4c7e8084fd467ddb2b0e6c6011f9c1064afb7e= 56 and fixed in 5.10.111 with commit 63ea57478aaa3e06a597081a0f537318fc04e4= 9f Issue introduced in 5.3 with commit 4c7e8084fd467ddb2b0e6c6011f9c1064afb7e= 56 and fixed in 5.15.34 with commit 907c97986d6fa77318d17659dd76c94b65dd27c5 Issue introduced in 5.3 with commit 4c7e8084fd467ddb2b0e6c6011f9c1064afb7e= 56 and fixed in 5.16.20 with commit dcd689f9e2640c992f94eae9955b106f71c6825d Issue introduced in 5.3 with commit 4c7e8084fd467ddb2b0e6c6011f9c1064afb7e= 56 and fixed in 5.17.3 with commit f8db5743d09523c0bb35f16e13691e3b7eb5dba0 Issue introduced in 5.3 with commit 4c7e8084fd467ddb2b0e6c6011f9c1064afb7e= 56 and fixed in 5.18 with commit 6bf92d70e690b7ff12b24f4bfff5e5434d019b82 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=3DCVE-2022-49092 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D The file(s) affected by this issue are: net/ipv4/fib_semantics.c Mitigation =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/f5064531c23ad646da7be8b938292b00a7e61438 https://git.kernel.org/stable/c/63ea57478aaa3e06a597081a0f537318fc04e49f https://git.kernel.org/stable/c/907c97986d6fa77318d17659dd76c94b65dd27c5 https://git.kernel.org/stable/c/dcd689f9e2640c992f94eae9955b106f71c6825d https://git.kernel.org/stable/c/f8db5743d09523c0bb35f16e13691e3b7eb5dba0 https://git.kernel.org/stable/c/6bf92d70e690b7ff12b24f4bfff5e5434d019b82