net: ipv4: fix route with nexthop object delete warning
In the Linux kernel, the following vulnerability has been resolved: net: ipv4: fix route with nexthop object delete warning FRR folks have hit a kernel warning[1] while deleting routes[2] which is caused by trying to delete a route pointing to a nexthop id without specifying nhid but matching on an interface. That is, a route is found but we hit a warning while matching it. The warning is from fib_info_nh() in include/net/nexthop.h because we run it on a fib_info with nexthop object. The call chain is: inet_rtm_delroute -> fib_table_delete -> fib_nh_match (called with a nexthop fib_info and also with fc_oif set thus calling fib_info_nh on the fib_info and triggering the warning). The fix is to not do any matching in that branch if the fi has a nexthop object because those are managed separately. I.e. we should match when deleting without nh spec and should fail when deleting a nexthop route with old-style nh spec because nexthop objects are managed separately, e.g.: $ ip r show 1.2.3.4/32 1.2.3.4 nhid 12 via 192.168.11.2 dev dummy0 $ ip r del 1.2.3.4/32 $ ip r del 1.2.3.4/32 nhid 12 $ ip r del 1.2.3.4/32 dev dummy0 [1] [ 523.462226] ------------[ cut here ]------------ [ 523.462230] WARNING: CPU: 14 PID: 22893 at include/net/nexthop.h:468 fib_nh_match+0x210/0x460 [ 523.462236] Modules linked in: dummy rpcsec_gss_krb5 xt_socket nf_socket_ipv4 nf_socket_ipv6 ip6table_raw iptable_raw bpf_preload xt_statistic ip_set ip_vs_sh ip_vs_wrr ip_vs_rr ip_vs xt_mark nf_tables xt_nat veth
CVE-2022-49092
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2022-49092
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4c7e8084fd467ddb2b0e6c6011f9c1064afb7e56",
"lessThan": "f5064531c23ad646da7be8b938292b00a7e61438",
"versionType": "git"
},
{
"status": "affected",
"version": "4c7e8084fd467ddb2b0e6c6011f9c1064afb7e56",
"lessThan": "63ea57478aaa3e06a597081a0f537318fc04e49f",
"versionType": "git"
},
{
"status": "affected",
"version": "4c7e8084fd467ddb2b0e6c6011f9c1064afb7e56",
"lessThan": "907c97986d6fa77318d17659dd76c94b65dd27c5",
"versionType": "git"
},
{
"status": "affected",
"version": "4c7e8084fd467ddb2b0e6c6011f9c1064afb7e56",
"lessThan": "dcd689f9e2640c992f94eae9955b106f71c6825d",
"versionType": "git"
},
{
"status": "affected",
"version": "4c7e8084fd467ddb2b0e6c6011f9c1064afb7e56",
"lessThan": "f8db5743d09523c0bb35f16e13691e3b7eb5dba0",
"versionType": "git"
},
{
"status": "affected",
"version": "4c7e8084fd467ddb2b0e6c6011f9c1064afb7e56",
"lessThan": "6bf92d70e690b7ff12b24f4bfff5e5434d019b82",
"versionType": "git"
}
],
"programFiles": [
"net/ipv4/fib_semantics.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.3"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.3",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.4.189",
"versionType": "semver",
"lessThanOrEqual": "5.4.*"
},
{
"status": "unaffected",
"version": "5.10.111",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.34",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "5.16.20",
"versionType": "semver",
"lessThanOrEqual": "5.16.*"
},
{
"status": "unaffected",
"version": "5.17.3",
"versionType": "semver",
"lessThanOrEqual": "5.17.*"
},
{
"status": "unaffected",
"version": "5.18",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/ipv4/fib_semantics.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2022-49092
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #30178 · Revision 1
- Added to Heist Feed
- Publisher date