[OE-core][PATCH] cve-exclusions: set status for CVE-2022-0400

[OE-core][PATCH] cve-exclusions: set status for CVE-2022-0400

[Junjie Cao]

The CVE describes an out-of-bounds read in the SMC protocol stack, but
the originating report, Red Hat bug 2040604, was never made public and
no tracker records affected code or a fix.

On request, Red Hat PSIRT identified the affected code (ticket
PSIRTSUPT-22046, summarized in the public bug [1]): the v2_ext_offset
field of an incoming CLC proposal message is used to compute a memory
offset without validation, in the chain smc_clc_msg_hdr_valid() ->
smc_clc_msg_prop_valid() -> smc_get_clc_v2_ext() (net/smc/smc_clc.h).

The unchecked read dates from the introduction of V2 CLC proposal
parsing in v5.10 (8c3dca341aea); at the time of the report,
smc_get_clc_v2_ext() checked the offset only for zero and
smc_clc_msg_prop_valid() dereferenced the resulting pointer. It is
closed by the v6.13 validation of exactly these fields:

  https://git.kernel.org/linus/7863c9f3d24ba49dbead7e03dfbe40deb5888fdf
  ("net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving
   proposal msg", v6.13)

The kernel CVE team assigned that commit CVE-2024-49568, recording the
issue introduced in 5.10 and fixed in 6.6.68, 6.12.7 and 6.13:

  https://lore.kernel.org/linux-cve-announce/2025011142-CVE-2024-49568-e5f6@gregkh/

CVE-2022-0400 predates the kernel CNA and no tracker has connected it
to this fix.

[1] https://bugzilla.redhat.com/show_bug.cgi?id=2044575#c23

CC: Paul Barker <paul@pbarker.dev>
AI-Generated: Uses Claude (claude-opus-5)
Signed-off-by: Junjie Cao <junjie.cao@linux.dev>
---
Previously 4/9 of the triage series: v3 proposed "disputed" and the
patch was dropped pending more information from Red Hat, which has now
been provided. Applies on top of the "triage eight kernel CVEs" v4
series.

v3: https://lore.kernel.org/openembedded-core/20260812072842.1176341-1-junjie.cao@linux.dev/

 meta/recipes-kernel/linux/cve-exclusion.inc | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/meta/recipes-kernel/linux/cve-exclusion.inc b/meta/recipes-kernel/linux/cve-exclusion.inc
index 8714173c..1505f9b3 100644
--- a/meta/recipes-kernel/linux/cve-exclusion.inc
+++ b/meta/recipes-kernel/linux/cve-exclusion.inc
@@ -260,3 +260,12 @@ CVE_STATUS[CVE-2023-6238] = "unpatched: Proposed fix was not merged"
 # https://ubuntu.com/security/CVE-2023-6240
 CVE_STATUS[CVE-2023-6240] = "unpatched: Fixed in RHEL but patch not identified \
 publicly"
+
+# The originating report (Red Hat bug 2040604) is not public. On request,
+# Red Hat PSIRT identified the affected code: the v2_ext_offset of an
+# incoming SMC CLC proposal message was used without validation in
+# net/smc/smc_clc.h. Introduced in v5.10, fixed by the v6.13 proposal
+# message validation, which upstream tracks as CVE-2024-49568.
+# https://bugzilla.redhat.com/show_bug.cgi?id=2044575#c23
+# Fix https://git.kernel.org/linus/7863c9f3d24ba49dbead7e03dfbe40deb5888fdf
+CVE_STATUS[CVE-2022-0400] = "fixed-version: Fixed from version 6.13"
-- 
2.43.0

Re: [OE-core][PATCH] cve-exclusions: set status for CVE-2022-0400

[Paul Barker]

On Sun, 2026-08-23 at 23:30 -0500, Junjie Cao wrote:
> The CVE describes an out-of-bounds read in the SMC protocol stack, but
> the originating report, Red Hat bug 2040604, was never made public and
> no tracker records affected code or a fix.
> 
> On request, Red Hat PSIRT identified the affected code (ticket
> PSIRTSUPT-22046, summarized in the public bug [1]): the v2_ext_offset
> field of an incoming CLC proposal message is used to compute a memory
> offset without validation, in the chain smc_clc_msg_hdr_valid() ->
> smc_clc_msg_prop_valid() -> smc_get_clc_v2_ext() (net/smc/smc_clc.h).
> 
> The unchecked read dates from the introduction of V2 CLC proposal
> parsing in v5.10 (8c3dca341aea); at the time of the report,
> smc_get_clc_v2_ext() checked the offset only for zero and
> smc_clc_msg_prop_valid() dereferenced the resulting pointer. It is
> closed by the v6.13 validation of exactly these fields:
> 
>   https://git.kernel.org/linus/7863c9f3d24ba49dbead7e03dfbe40deb5888fdf
>   ("net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving
>    proposal msg", v6.13)
> 
> The kernel CVE team assigned that commit CVE-2024-49568, recording the
> issue introduced in 5.10 and fixed in 6.6.68, 6.12.7 and 6.13:
> 
>   https://lore.kernel.org/linux-cve-announce/2025011142-CVE-2024-49568-e5f6@gregkh/
> 
> CVE-2022-0400 predates the kernel CNA and no tracker has connected it
> to this fix.
> 
> [1] https://bugzilla.redhat.com/show_bug.cgi?id=2044575#c23
> 
> CC: Paul Barker <paul@pbarker.dev>
> AI-Generated: Uses Claude (claude-opus-5)
> Signed-off-by: Junjie Cao <junjie.cao@linux.dev>

Thanks for following this up!

One nitpick...

> +# The originating report (Red Hat bug 2040604) is not public. On request,
> +# Red Hat PSIRT identified the affected code: the v2_ext_offset of an
> +# incoming SMC CLC proposal message was used without validation in
> +# net/smc/smc_clc.h. Introduced in v5.10, fixed by the v6.13 proposal
> +# message validation, which upstream tracks as CVE-2024-49568.
> +# https://bugzilla.redhat.com/show_bug.cgi?id=2044575#c23
> +# Fix https://git.kernel.org/linus/7863c9f3d24ba49dbead7e03dfbe40deb5888fdf
> +CVE_STATUS[CVE-2022-0400] = "fixed-version: Fixed from version 6.13"

We can say 6.13rc4 here.

Best regards,

-- 
Paul Barker

Re: [OE-core][PATCH] cve-exclusions: set status for CVE-2022-0400

[Junjie Cao]

On Mon, 24 Aug 2026, Paul Barker wrote:
> We can say 6.13rc4 here.

Right, v2 sent:

  https://lore.kernel.org/openembedded-core/20260824155219.1562450-1-junjie.cao@linux.dev/

Richard, that supersedes 3247c267 in master-next.