cve/published/2022/CVE-2022-49691.mbox

From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: <linux-cve-announce@vger.kernel.org>
Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
Subject: CVE-2022-49691: erspan: do not assume transport header is always set

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

erspan: do not assume transport header is always set

Rewrite tests in ip6erspan_tunnel_xmit() and
erspan_fb_xmit() to not assume transport header is set.

syzbot reported:

WARNING: CPU: 0 PID: 1350 at include/linux/skbuff.h:2911 skb_transport_header include/linux/skbuff.h:2911 [inline]
WARNING: CPU: 0 PID: 1350 at include/linux/skbuff.h:2911 ip6erspan_tunnel_xmit+0x15af/0x2eb0 net/ipv6/ip6_gre.c:963
Modules linked in:
CPU: 0 PID: 1350 Comm: aoe_tx0 Not tainted 5.19.0-rc2-syzkaller-00160-g274295c6e53f #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
RIP: 0010:skb_transport_header include/linux/skbuff.h:2911 [inline]
RIP: 0010:ip6erspan_tunnel_xmit+0x15af/0x2eb0 net/ipv6/ip6_gre.c:963
Code: 0f 47 f0 40 88 b5 7f fe ff ff e8 8c 16 4b f9 89 de bf ff ff ff ff e8 a0 12 4b f9 66 83 fb ff 0f 85 1d f1 ff ff e8 71 16 4b f9 <0f> 0b e9 43 f0 ff ff e8 65 16 4b f9 48 8d 85 30 ff ff ff ba 60 00
RSP: 0018:ffffc90005daf910 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 000000000000ffff RCX: 0000000000000000
RDX: ffff88801f032100 RSI: ffffffff882e8d3f RDI: 0000000000000003
RBP: ffffc90005dafab8 R08: 0000000000000003 R09: 000000000000ffff
R10: 000000000000ffff R11: 0000000000000000 R12: ffff888024f21d40
R13: 000000000000a288 R14: 00000000000000b0 R15: ffff888025a2e000
FS: 0000000000000000(0000) GS:ffff88802c800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2e425000 CR3: 000000006d099000 CR4: 0000000000152ef0
Call Trace:
<TASK>
__netdev_start_xmit include/linux/netdevice.h:4805 [inline]
netdev_start_xmit include/linux/netdevice.h:4819 [inline]
xmit_one net/core/dev.c:3588 [inline]
dev_hard_start_xmit+0x188/0x880 net/core/dev.c:3604
sch_direct_xmit+0x19f/0xbe0 net/sched/sch_generic.c:342
__dev_xmit_skb net/core/dev.c:3815 [inline]
__dev_queue_xmit+0x14a1/0x3900 net/core/dev.c:4219
dev_queue_xmit include/linux/netdevice.h:2994 [inline]
tx+0x6a/0xc0 drivers/block/aoe/aoenet.c:63
kthread+0x1e7/0x3b0 drivers/block/aoe/aoecmd.c:1229
kthread+0x2e9/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302
</TASK>

The Linux kernel CVE team has assigned CVE-2022-49691 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.18 with commit d5db21a3e6977dcb42cee3d16cd69901fa66510a and fixed in 4.19.250 with commit fb401f37f6eadf24956d93687e5758c163c0d12b
	Issue introduced in 4.18 with commit d5db21a3e6977dcb42cee3d16cd69901fa66510a and fixed in 5.4.202 with commit 02da602bc2f353dccd9e489a604490034ded941e
	Issue introduced in 4.18 with commit d5db21a3e6977dcb42cee3d16cd69901fa66510a and fixed in 5.10.127 with commit cec9867ee55478ef5dcb2adf030fe0c442a4c4ee
	Issue introduced in 4.18 with commit d5db21a3e6977dcb42cee3d16cd69901fa66510a and fixed in 5.15.51 with commit a3b2470399f679587c45abe56e551caf10becca2
	Issue introduced in 4.18 with commit d5db21a3e6977dcb42cee3d16cd69901fa66510a and fixed in 5.18.8 with commit 2c8aeffc7c586d53e1d380f010bdca4f710f2480
	Issue introduced in 4.18 with commit d5db21a3e6977dcb42cee3d16cd69901fa66510a and fixed in 5.19 with commit 301bd140ed0b24f0da660874c7e8a47dad8c8222

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-49691
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/ipv4/ip_gre.c
	net/ipv6/ip6_gre.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/fb401f37f6eadf24956d93687e5758c163c0d12b
	https://git.kernel.org/stable/c/02da602bc2f353dccd9e489a604490034ded941e
	https://git.kernel.org/stable/c/cec9867ee55478ef5dcb2adf030fe0c442a4c4ee
	https://git.kernel.org/stable/c/a3b2470399f679587c45abe56e551caf10becca2
	https://git.kernel.org/stable/c/2c8aeffc7c586d53e1d380f010bdca4f710f2480
	https://git.kernel.org/stable/c/301bd140ed0b24f0da660874c7e8a47dad8c8222