In the Linux kernel, the following vulnerability has been resolved:
netfilter: nftables: avoid skb access on nfstolen
When verdict is NF_STOLEN, the skb might have been freed.
When tracing is enabled, this can result in a use-after-free: 1. access to skb->nf_trace 2. access to skb->mark 3. computation of trace id 4. dump of packet payload
To avoid 1, keep a cached copy of skb->nf_trace in the trace state struct. Refresh this copy whenever verdict is != STOLEN.
Avoid 2 by skipping skb->mark access if verdict is STOLEN.
3 is avoided by precomputing the trace id.
Only dump the packet when verdict is not "STOLEN".
[ { "signature_type": "Function", "id": "CVE-2022-49622-047d5561", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e34b9ed96ce3b06c79bf884009b16961ca478f87", "signature_version": "v1", "target": { "function": "nft_trace_init", "file": "net/netfilter/nf_tables_trace.c" }, "digest": { "function_hash": "330482719423693018478356319583688017884", "length": 251.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2022-49622-19e27fcd", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0016d5d46d7440729a3132f61a8da3bf7f84e2ba", "signature_version": "v1", "target": { "function": "__nft_trace_verdict", "file": "net/netfilter/nf_tables_core.c" }, "digest": { "function_hash": "66060635111994115686302384484609840522", "length": 293.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2022-49622-24bb2a4a", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0016d5d46d7440729a3132f61a8da3bf7f84e2ba", "signature_version": "v1", "target": { "file": "include/net/netfilter/nf_tables.h" }, "digest": { "threshold": 0.9, "line_hashes": [ "164820833715891089430184564785028889275", "200940400721543839762420151036735805897", "118113393231762589433366377953713669425", "54020392689208143623504546745308650516", "85441613818882597557832833086338323922", "11812697784434621440681581343628432920", "239705040021757267959585679731928969780", "252594741057405697496408856982411658531", "19462155902581124022434460782969241449", "156868702792929834528859585034229871725", "65611644060413813995278861081267931656", "160414367320171713645363714503034645117" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2022-49622-24e2ead9", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e34b9ed96ce3b06c79bf884009b16961ca478f87", "signature_version": "v1", "target": { "function": "nft_trace_notify", "file": "net/netfilter/nf_tables_trace.c" }, "digest": { "function_hash": "119681140788185333669753154498851536395", "length": 2562.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2022-49622-35acf00b", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0016d5d46d7440729a3132f61a8da3bf7f84e2ba", "signature_version": "v1", "target": { "function": "nft_do_chain", "file": "net/netfilter/nf_tables_core.c" }, "digest": { "function_hash": "269605491729668309442624848586485874471", "length": 2253.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2022-49622-35e5ff49", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e34b9ed96ce3b06c79bf884009b16961ca478f87", "signature_version": "v1", "target": { "function": "__nft_trace_verdict", "file": "net/netfilter/nf_tables_core.c" }, "digest": { "function_hash": "66060635111994115686302384484609840522", "length": 293.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2022-49622-3e26cecc", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e34b9ed96ce3b06c79bf884009b16961ca478f87", "signature_version": "v1", "target": { "function": "nft_do_chain", "file": "net/netfilter/nf_tables_core.c" }, "digest": { "function_hash": "269605491729668309442624848586485874471", "length": 2253.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2022-49622-5903d8d8", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e34b9ed96ce3b06c79bf884009b16961ca478f87", "signature_version": "v1", "target": { "function": "nft_trace_packet", "file": "net/netfilter/nf_tables_core.c" }, "digest": { "function_hash": "71292364106710235414886505454262471407", "length": 214.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2022-49622-610e5b68", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0016d5d46d7440729a3132f61a8da3bf7f84e2ba", "signature_version": "v1", "target": { "function": "nft_trace_packet", "file": "net/netfilter/nf_tables_core.c" }, "digest": { "function_hash": "71292364106710235414886505454262471407", "length": 214.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2022-49622-76c4c8ef", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e34b9ed96ce3b06c79bf884009b16961ca478f87", "signature_version": "v1", "target": { "file": "include/net/netfilter/nf_tables.h" }, "digest": { "threshold": 0.9, "line_hashes": [ "164820833715891089430184564785028889275", "200940400721543839762420151036735805897", "118113393231762589433366377953713669425", "54020392689208143623504546745308650516", "85441613818882597557832833086338323922", "11812697784434621440681581343628432920", "239705040021757267959585679731928969780", "252594741057405697496408856982411658531", "19462155902581124022434460782969241449", "156868702792929834528859585034229871725", "65611644060413813995278861081267931656", "160414367320171713645363714503034645117" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2022-49622-7a6cba36", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e34b9ed96ce3b06c79bf884009b16961ca478f87", "signature_version": "v1", "target": { "file": "net/netfilter/nf_tables_trace.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "112573555139394341497496207643559392122", "265018912672193395106970308952311978852", "266951602148770075296920863563431912544", "174437108363517973859093196803565065672", "17677002644239492613511571206489099110", "138107863240210609169325082741362259925", "124503076535032389901032250867481441214", "34698789541638229716428422901493529634", "331332738799357948562261678428023775000", "276826460583371861633963282342491336359", "175664592867271560833418350094017011594", "204341131149065529181549010560798703288", "145374939959010136076424949908473977717", "101386063591314308870872699336182957622", "68770076623121180900584736020398953379", "267375781911331498147565612728845830807", "67402557639863747572015807255895892538", "140355612406939506687515504277035561965", "87858885598674333154149937079569089489", "165732936879055949359753626198748151746", "45265009341918954828213574831855596116", "33419016807162284601185579804903038670", "4008867844914369143196094787050148884", "234986327914479601709647457761381466352", "290887436104906707356646474987089784171", "27104795994654543112660781693195216953", "121969753021042877103581038353661166792", "151599107193761269424004443101411981003", "29390823275584317218944417107030465906", "123353503012982767612913034618283678006", "55131440927415274675617751215539317879", "258546113887812335904528052859572131171", "228815672884959773405432403592208719057", "211269168317580140792427002859677601429", "12635470102639118176488967450408437545", "244623440397478328830319720785446064363", "150339330293163503707154501204872381213", "27736187645930695006544991992042287454", "160032143339765378266566031260607997739", "32052844614438474760601650518674840463", "254767618210901140325905158201504012759", "170050129539913281595505152867018255036" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2022-49622-959ad7ae", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0016d5d46d7440729a3132f61a8da3bf7f84e2ba", "signature_version": "v1", "target": { "file": "net/netfilter/nf_tables_core.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "32806092703404758483965756521800882649", "260698652475501382684759315798531755620", "294555209443196156520796894328301697310", "67639628731641480778203134258453790289", "320087673500643029714244478067117181866", "168194400176864880639671762167593745933", "165328386161619603716715296629591833703", "189104234499585682790267922995868078654", "270451213015291951255486753501034006626", "229961065602964675245193658159508967032", "81273795513494881375291264235746378517", "55094196363542917302401432735874600768", "117113930887454860928512290186484602020", "46996468251123633801357573371854511615", "227728038524494311098461850943359987381", "68941321321663807187290636122673628069", "225196333380054918580511700844625462912", "28498120536529437713815178693239141291", "317355023993589560315082541678532110427", "154460556756945023019382914666338313923", "185397923448994712102288621940256555944", "188046381736330780996061052948756248888", "216395038589649220358093645214771235788", "65567061381397010610671765809513087854", "39854772893343308684456954500758379911", "310156560240515062752050667798583513303", "6874233498191789047083140067338474496" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2022-49622-a17a6146", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0016d5d46d7440729a3132f61a8da3bf7f84e2ba", "signature_version": "v1", "target": { "function": "__nft_trace_packet", "file": "net/netfilter/nf_tables_core.c" }, "digest": { "function_hash": "260693954617491072049851418410466162655", "length": 246.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2022-49622-a3fe8d25", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0016d5d46d7440729a3132f61a8da3bf7f84e2ba", "signature_version": "v1", "target": { "function": "nft_trace_init", "file": "net/netfilter/nf_tables_trace.c" }, "digest": { "function_hash": "330482719423693018478356319583688017884", "length": 251.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2022-49622-a7f8ccc5", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0016d5d46d7440729a3132f61a8da3bf7f84e2ba", "signature_version": "v1", "target": { "file": "net/netfilter/nf_tables_trace.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "112573555139394341497496207643559392122", "265018912672193395106970308952311978852", "266951602148770075296920863563431912544", "174437108363517973859093196803565065672", "17677002644239492613511571206489099110", "138107863240210609169325082741362259925", "124503076535032389901032250867481441214", "34698789541638229716428422901493529634", "331332738799357948562261678428023775000", "276826460583371861633963282342491336359", "175664592867271560833418350094017011594", "204341131149065529181549010560798703288", "145374939959010136076424949908473977717", "101386063591314308870872699336182957622", "68770076623121180900584736020398953379", "267375781911331498147565612728845830807", "67402557639863747572015807255895892538", "140355612406939506687515504277035561965", "87858885598674333154149937079569089489", "165732936879055949359753626198748151746", "45265009341918954828213574831855596116", "33419016807162284601185579804903038670", "4008867844914369143196094787050148884", "234986327914479601709647457761381466352", "290887436104906707356646474987089784171", "27104795994654543112660781693195216953", "121969753021042877103581038353661166792", "151599107193761269424004443101411981003", "29390823275584317218944417107030465906", "123353503012982767612913034618283678006", "55131440927415274675617751215539317879", "258546113887812335904528052859572131171", "228815672884959773405432403592208719057", "211269168317580140792427002859677601429", "12635470102639118176488967450408437545", "244623440397478328830319720785446064363", "150339330293163503707154501204872381213", "27736187645930695006544991992042287454", "160032143339765378266566031260607997739", "32052844614438474760601650518674840463", "254767618210901140325905158201504012759", "170050129539913281595505152867018255036" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2022-49622-bcc367c2", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e34b9ed96ce3b06c79bf884009b16961ca478f87", "signature_version": "v1", "target": { "file": "net/netfilter/nf_tables_core.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "32806092703404758483965756521800882649", "260698652475501382684759315798531755620", "294555209443196156520796894328301697310", "67639628731641480778203134258453790289", "320087673500643029714244478067117181866", "168194400176864880639671762167593745933", "165328386161619603716715296629591833703", "189104234499585682790267922995868078654", "270451213015291951255486753501034006626", "229961065602964675245193658159508967032", "81273795513494881375291264235746378517", "55094196363542917302401432735874600768", "117113930887454860928512290186484602020", "46996468251123633801357573371854511615", "227728038524494311098461850943359987381", "68941321321663807187290636122673628069", "225196333380054918580511700844625462912", "28498120536529437713815178693239141291", "317355023993589560315082541678532110427", "154460556756945023019382914666338313923", "185397923448994712102288621940256555944", "188046381736330780996061052948756248888", "216395038589649220358093645214771235788", "65567061381397010610671765809513087854", "39854772893343308684456954500758379911", "310156560240515062752050667798583513303", "6874233498191789047083140067338474496" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2022-49622-c8975109", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e34b9ed96ce3b06c79bf884009b16961ca478f87", "signature_version": "v1", "target": { "function": "__nft_trace_packet", "file": "net/netfilter/nf_tables_core.c" }, "digest": { "function_hash": "260693954617491072049851418410466162655", "length": 246.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2022-49622-c9544b27", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e34b9ed96ce3b06c79bf884009b16961ca478f87", "signature_version": "v1", "target": { "function": "trace_fill_id", "file": "net/netfilter/nf_tables_trace.c" }, "digest": { "function_hash": "292207718724879769341015083815186861817", "length": 211.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2022-49622-f9dae7d3", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0016d5d46d7440729a3132f61a8da3bf7f84e2ba", "signature_version": "v1", "target": { "function": "trace_fill_id", "file": "net/netfilter/nf_tables_trace.c" }, "digest": { "function_hash": "292207718724879769341015083815186861817", "length": 211.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2022-49622-fd1a52b5", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0016d5d46d7440729a3132f61a8da3bf7f84e2ba", "signature_version": "v1", "target": { "function": "nft_trace_notify", "file": "net/netfilter/nf_tables_trace.c" }, "digest": { "function_hash": "119681140788185333669753154498851536395", "length": 2562.0 }, "deprecated": false } ]