Skip to content
Heist/ feed
High

net: ipv4: fix route with nexthop object delete warning

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: net: ipv4: fix route with nexthop object delete warning FRR folks have hit a kernel warning[1] while deleting routes[2] which is caused by trying to delete a route pointing to a nexthop id without specifying nhid but matching on an interface. That is, a route is found but we hit a warning while matching it. The warning is from fib_info_nh() in include/net/nexthop.h because we run it on a fib_info with nexthop object. The call chain is: inet_rtm_delroute -> fib_table_delete -> fib_nh_match (called with a nexthop fib_info and also with fc_oif set thus calling fib_info_nh on the fib_info and triggering the warning). The fix is to not do any matching in that branch if the fi has a nexthop object because those are managed separately. I.e. we should match when deleting without nh spec and should fail when deleting a nexthop route with old-style nh spec because nexthop objects are managed separately, e.g.: $ ip r show 1.2.3.4/32 1.2.3.4 nhid 12 via 192.168.11.2 dev dummy0 $ ip r del 1.2.3.4/32 $ ip r del 1.2.3.4/32 nhid 12 $ ip r del 1.2.3.4/32 dev dummy0 [1] [ 523.462226] ------------[ cut here ]------------ [ 523.462230] WARNING: CPU: 14 PID: 22893 at include/net/nexthop.h:468 fib_nh_match+0x210/0x460 [ 523.462236] Modules linked in: dummy rpcsec_gss_krb5 xt_socket nf_socket_ipv4 nf_socket_ipv6 ip6table_raw iptable_raw bpf_preload xt_statistic ip_set ip_vs_sh ip_vs_wrr ip_vs_rr ip_vs xt_mark nf_tables xt_nat veth

Announced Source revision 1
Original source ↗

CVE-2022-49092

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2022-49092

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "4c7e8084fd467ddb2b0e6c6011f9c1064afb7e56",
        "lessThan": "f5064531c23ad646da7be8b938292b00a7e61438",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "4c7e8084fd467ddb2b0e6c6011f9c1064afb7e56",
        "lessThan": "63ea57478aaa3e06a597081a0f537318fc04e49f",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "4c7e8084fd467ddb2b0e6c6011f9c1064afb7e56",
        "lessThan": "907c97986d6fa77318d17659dd76c94b65dd27c5",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "4c7e8084fd467ddb2b0e6c6011f9c1064afb7e56",
        "lessThan": "dcd689f9e2640c992f94eae9955b106f71c6825d",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "4c7e8084fd467ddb2b0e6c6011f9c1064afb7e56",
        "lessThan": "f8db5743d09523c0bb35f16e13691e3b7eb5dba0",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "4c7e8084fd467ddb2b0e6c6011f9c1064afb7e56",
        "lessThan": "6bf92d70e690b7ff12b24f4bfff5e5434d019b82",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "net/ipv4/fib_semantics.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "5.3"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "5.3",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "5.4.189",
        "versionType": "semver",
        "lessThanOrEqual": "5.4.*"
      },
      {
        "status": "unaffected",
        "version": "5.10.111",
        "versionType": "semver",
        "lessThanOrEqual": "5.10.*"
      },
      {
        "status": "unaffected",
        "version": "5.15.34",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "5.16.20",
        "versionType": "semver",
        "lessThanOrEqual": "5.16.*"
      },
      {
        "status": "unaffected",
        "version": "5.17.3",
        "versionType": "semver",
        "lessThanOrEqual": "5.17.*"
      },
      {
        "status": "unaffected",
        "version": "5.18",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "net/ipv4/fib_semantics.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2022-49092

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#30178 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement