| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2022-49086: net: openvswitch: fix leak of nested actions |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| net: openvswitch: fix leak of nested actions |
| |
| While parsing user-provided actions, openvswitch module may dynamically |
| allocate memory and store pointers in the internal copy of the actions. |
| So this memory has to be freed while destroying the actions. |
| |
| Currently there are only two such actions: ct() and set(). However, |
| there are many actions that can hold nested lists of actions and |
| ovs_nla_free_flow_actions() just jumps over them leaking the memory. |
| |
| For example, removal of the flow with the following actions will lead |
| to a leak of the memory allocated by nf_ct_tmpl_alloc(): |
| |
| actions:clone(ct(commit),0) |
| |
| Non-freed set() action may also leak the 'dst' structure for the |
| tunnel info including device references. |
| |
| Under certain conditions with a high rate of flow rotation that may |
| cause significant memory leak problem (2MB per second in reporter's |
| case). The problem is also hard to mitigate, because the user doesn't |
| have direct control over the datapath flows generated by OVS. |
| |
| Fix that by iterating over all the nested actions and freeing |
| everything that needs to be freed recursively. |
| |
| New build time assertion should protect us from this problem if new |
| actions will be added in the future. |
| |
| Unfortunately, openvswitch module doesn't use NLA_F_NESTED, so all |
| attributes has to be explicitly checked. sample() and clone() actions |
| are mixing extra attributes into the user-provided action list. That |
| prevents some code generalization too. |
| |
| The Linux kernel CVE team has assigned CVE-2022-49086 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 4.3 with commit 34ae932a40369be6bd6ea97d66b6686361b4370d and fixed in 4.19.249 with commit 7438dc55c0709819b813f4778aec2c48b782990b |
| Issue introduced in 4.3 with commit 34ae932a40369be6bd6ea97d66b6686361b4370d and fixed in 5.4.200 with commit ef6f9ce0a79aa23b10fc5f3b3cab3814a25aac40 |
| Issue introduced in 4.3 with commit 34ae932a40369be6bd6ea97d66b6686361b4370d and fixed in 5.10.111 with commit 5ae05b5eb58773cfec307ff88aff4cfd843c4cff |
| Issue introduced in 4.3 with commit 34ae932a40369be6bd6ea97d66b6686361b4370d and fixed in 5.15.34 with commit 837b96d8103938e35e7d92cd9db96af914ca4fff |
| Issue introduced in 4.3 with commit 34ae932a40369be6bd6ea97d66b6686361b4370d and fixed in 5.16.20 with commit 3554c214b83ec9a839ed574263a34218f372990c |
| Issue introduced in 4.3 with commit 34ae932a40369be6bd6ea97d66b6686361b4370d and fixed in 5.17.3 with commit 53bce9d19b0a9d245b25cd050b81652ed974a509 |
| Issue introduced in 4.3 with commit 34ae932a40369be6bd6ea97d66b6686361b4370d and fixed in 5.18 with commit 1f30fb9166d4f15a1aa19449b9da871fe0ed4796 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2022-49086 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| net/openvswitch/flow_netlink.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/7438dc55c0709819b813f4778aec2c48b782990b |
| https://git.kernel.org/stable/c/ef6f9ce0a79aa23b10fc5f3b3cab3814a25aac40 |
| https://git.kernel.org/stable/c/5ae05b5eb58773cfec307ff88aff4cfd843c4cff |
| https://git.kernel.org/stable/c/837b96d8103938e35e7d92cd9db96af914ca4fff |
| https://git.kernel.org/stable/c/3554c214b83ec9a839ed574263a34218f372990c |
| https://git.kernel.org/stable/c/53bce9d19b0a9d245b25cd050b81652ed974a509 |
| https://git.kernel.org/stable/c/1f30fb9166d4f15a1aa19449b9da871fe0ed4796 |
