An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of actions, while copying and reserving memory for a new action of a new flow, the reservesfasize() function does not return -EMSGSIZE as expected, potentially leading to an out-of-bounds write access. This flaw allows a local user to crash or potentially escalate their privileges on the system.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-2639.json"
[
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/torvalds/linux/commit/cefa91b2332d7009bc0be5d951d6cbbf349f90f8",
"digest": {
"line_hashes": [
"65425590785192723994623587729074796049",
"71302186463290615025867454209150422709",
"279362120354327615894429077599479133076",
"332522869488065027272036854372203801210"
],
"threshold": 0.9
},
"id": "CVE-2022-2639-9d6196ce",
"deprecated": false,
"target": {
"file": "net/openvswitch/flow_netlink.c"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/torvalds/linux/commit/cefa91b2332d7009bc0be5d951d6cbbf349f90f8",
"digest": {
"function_hash": "30959647629553362889335068607156747230",
"length": 981.0
},
"id": "CVE-2022-2639-c1d2079a",
"deprecated": false,
"target": {
"file": "net/openvswitch/flow_netlink.c",
"function": "reserve_sfa_size"
}
}
]