CVE-2022-49066
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2022-49066
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-49066.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2022-49066
- Related
- Published
- 2025-02-26T07:00:43Z
- Modified
- 2025-02-26T19:02:48.245465Z
- Downstream
- Summary
- [none]
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
veth: Ensure eth header is in skb's linear part
After feeding a decapsulated packet to a veth device with actmirred, skbheadlen() may be 0. But vethxmit() calls _devforwardskb(), which expects at least ETHHLEN byte of linear data (as _devforwardskb2() calls ethtypetrans(), which pulls ETH_HLEN bytes unconditionally).
Use pskbmaypull() to ensure veth_xmit() respects this constraint.
kernel BUG at include/linux/skbuff.h:2328! RIP: 0010:ethtypetrans+0xcf/0x140 Call Trace: <IRQ> _devforwardskb2+0xe3/0x160 vethxmit+0x6e/0x250 [veth] devhardstartxmit+0xc7/0x200 _devqueuexmit+0x47f/0x520 ? skbensurewritable+0x85/0xa0 ? skbmplspop+0x98/0x1c0 tcfmirredact+0x442/0x47e [actmirred] tcfactionexec+0x86/0x140 flclassify+0x1d8/0x1e0 [clsflower] ? dmapteclearlevel+0x129/0x1a0 ? dmapteclearlevel+0x129/0x1a0 ? prbfillcurrblock+0x2f/0xc0 ? skbcopybits+0x11a/0x220 _tcfclassify+0x58/0x110 tcfclassifyingress+0x6b/0x140 _netifreceiveskbcore.constprop.0+0x47d/0xfd0 ? _iommudmaunmapswiotlb+0x44/0x90 _netifreceiveskbonecore+0x3d/0xa0 netifreceiveskb+0x116/0x170 beprocessrx+0x22f/0x330 [be2net] bepoll+0x13c/0x370 [be2net] _napipoll+0x2a/0x170 netrxaction+0x22f/0x2f0 _dosoftirq+0xca/0x2a8 _irqexitrcu+0xc1/0xe0 commoninterrupt+0x83/0xa0
- References
-
- https://git.kernel.org/stable/c/1ef0088e43af1de4e3b365218c4d3179d9a37eec
- https://git.kernel.org/stable/c/2fd90b86dff413fbf8128780c04ea9c6849c16e2
- https://git.kernel.org/stable/c/3de2a02b60a4ef0ab76263216f08c7d095fc7c42
- https://git.kernel.org/stable/c/46bc359fec0c6d87b70d7a008bcd9a5e30dd6f27
- https://git.kernel.org/stable/c/726e2c5929de841fdcef4e2bf995680688ae1b87
- https://git.kernel.org/stable/c/93940fc4cb81840dc0fa202de48cccb949a0261d
- https://git.kernel.org/stable/c/d417a859221f127e8edf09c14b76ab50f825e171
- https://git.kernel.org/stable/c/d67c900f1947d64ba8a64f693504bcaab8d9000c
- https://security-tracker.debian.org/tracker/CVE-2022-49066
Affected packages
Debian:11 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed5.10.113-1
Debian:12 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source
Debian:13 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source