CVE-2022-48711
See a problem?- Source
- https://nvd.nist.gov/vuln/detail/CVE-2022-48711
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-48711.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2022-48711
- Related
- Published
- 2024-06-20T11:15:54Z
- Modified
- 2024-09-11T04:57:00.003850Z
- Summary
- [none]
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
tipc: improve size validations for received domain records
The function tipcmonrcv() allows a node to receive and process domain_record structs from peer nodes to track their views of the network topology.
This patch verifies that the number of members in a received domain record does not exceed the limit defined by MAXMONDOMAIN, something that may otherwise lead to a stack overflow.
tipcmonrcv() is called from the function tipclinkproto_rcv(), where we are reading a 32 bit message data length field into a uint16. To avert any risk of bit overflow, we add an extra sanity check for this in that function. We cannot see that happen with the current code, but future designers being unaware of this risk, may introduce it by allowing delivery of very large (> 64k) sk buffers from the bearer layer. This potential problem was identified by Eric Dumazet.
This fixes CVE-2022-0435
- References
-
- https://git.kernel.org/stable/c/175db196e45d6f0e6047eccd09c8ba55465eb131
- https://git.kernel.org/stable/c/1f1788616157b0222b0c2153828b475d95e374a7
- https://git.kernel.org/stable/c/3c7e5943553594f68bbc070683db6bb6f6e9e78e
- https://git.kernel.org/stable/c/59ff7514f8c56f166aadca49bcecfa028e0ad50f
- https://git.kernel.org/stable/c/9aa422ad326634b76309e8ff342c246800621216
- https://git.kernel.org/stable/c/d692e3406e052dbf9f6d9da0cba36cb763272529
- https://git.kernel.org/stable/c/f1af11edd08dd8376f7a84487cbb0ea8203e3a1d
- https://git.kernel.org/stable/c/fde4ddeadd099bf9fbb9ccbee8e1b5c20d530a2d
- https://security-tracker.debian.org/tracker/CVE-2022-48711
Affected packages
Debian:11 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed5.10.103-1
Debian:12 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source
Debian:13 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source