net: preserve skb_end_offset() in skb_unclone_keeptruesize()
In the Linux kernel, the following vulnerability has been resolved: net: preserve skb_end_offset() in skb_unclone_keeptruesize() syzbot found another way to trigger the infamous WARN_ON_ONCE(delta < len) in skb_try_coalesce() [1] I was able to root cause the issue to kfence. When kfence is in action, the following assertion is no longer true: int size = xxxx; void *ptr1 = kmalloc(size, gfp); void *ptr2 = kmalloc(size, gfp); if (ptr1 && ptr2) ASSERT(ksize(ptr1) == ksize(ptr2)); We attempted to fix these issues in the blamed commits, but forgot that TCP was possibly shifting data after skb_unclone_keeptruesize() has been used, notably from tcp_retrans_try_collapse(). So we not only need to keep same skb->truesize value, we also need to make sure TCP wont fill new tailroom that pskb_expand_head() was able to get from a addr = kmalloc(...) followed by ksize(addr) Split skb_unclone_keeptruesize() into two parts: 1) Inline skb_unclone_keeptruesize() for the common case, when skb is not cloned. 2) Out of line __skb_unclone_keeptruesize() for the 'slow path'. WARNING: CPU: 1 PID: 6490 at net/core/skbuff.c:5295 skb_try_coalesce+0x1235/0x1560 net/core/skbuff.c:5295 Modules linked in: CPU: 1 PID: 6490 Comm: syz-executor161 Not tainted 5.17.0-rc4-syzkaller-00229-g4f12b742eb2b #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:skb_try_coalesce+0x1235/0x1560 net/core/skbuff.c:5295 Code: bf 01 00 00 00 0f b7 c0 89 c6 89 44 24 20 e8 62 24 4
CVE-2022-49142
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2022-49142
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "35ca1748ebf8d3a1025d55c85f4b96add952ed20",
"lessThan": "91c118727432a5d776d5fe86e0cf8eb1289ac1fc",
"versionType": "git"
},
{
"status": "affected",
"version": "097b9146c0e26aabaa6ff3e5ea536a53f5254a79",
"lessThan": "23629b673b780d967b88a850b1518cf0f0ffc6aa",
"versionType": "git"
},
{
"status": "affected",
"version": "097b9146c0e26aabaa6ff3e5ea536a53f5254a79",
"lessThan": "a9a6d30264327d8ff7f23da33e7a77ffb793fa3f",
"versionType": "git"
},
{
"status": "affected",
"version": "097b9146c0e26aabaa6ff3e5ea536a53f5254a79",
"lessThan": "a903e516f5df44b46d526b403d93e7be1a425538",
"versionType": "git"
},
{
"status": "affected",
"version": "097b9146c0e26aabaa6ff3e5ea536a53f5254a79",
"lessThan": "2b88cba55883eaafbc9b7cbff0b2c7cdba71ed01",
"versionType": "git"
},
{
"status": "affected",
"version": "7118945cdf0d4b5a76eb4f5f330ac6f48d372025",
"versionType": "git"
},
{
"status": "affected",
"version": "ec697f7f3f6a89d4dd1af113587d0330b5a033e8",
"versionType": "git"
},
{
"status": "affected",
"version": "7582edf28f5d1f0a4d2f7abdb7d9560d09fd41b5",
"versionType": "git"
},
{
"status": "affected",
"version": "5d55a6a46a7f70bc1d270c50200edd3096cb380c",
"versionType": "git"
},
{
"status": "affected",
"version": "e6af7cb64b7b37b8a371acdbe33a636496ffb5a4",
"versionType": "git"
},
{
"status": "affected",
"version": "97ff09a7ed484fef2b1bbc103857444b7332fca8",
"versionType": "git"
},
{
"status": "affected",
"version": "bf5a58d143d7899d2c89e585be6e98ec81fe9683",
"versionType": "git"
},
{
"status": "affected",
"version": "4.4.260",
"lessThan": "4.5",
"versionType": "semver"
},
{
"status": "affected",
"version": "4.9.260",
"lessThan": "4.10",
"versionType": "semver"
},
{
"status": "affected",
"version": "4.14.224",
"lessThan": "4.15",
"versionType": "semver"
},
{
"status": "affected",
"version": "4.19.179",
"lessThan": "4.20",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.4.103",
"lessThan": "5.5",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.11.4",
"lessThan": "5.12",
"versionType": "semver"
}
],
"programFiles": [
"include/linux/skbuff.h",
"net/core/skbuff.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.12"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.12",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.15.33",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "5.16.19",
"versionType": "semver",
"lessThanOrEqual": "5.16.*"
},
{
"status": "unaffected",
"version": "5.17.2",
"versionType": "semver",
"lessThanOrEqual": "5.17.*"
},
{
"status": "unaffected",
"version": "5.18",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"include/linux/skbuff.h",
"net/core/skbuff.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2022-49142
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #8207 · Revision 1
- Added to Heist Feed
- Publisher date