In the Linux kernel, the following vulnerability has been resolved:
tipc: improve size validations for received domain records
The function tipcmonrcv() allows a node to receive and process domain_record structs from peer nodes to track their views of the network topology.
This patch verifies that the number of members in a received domain record does not exceed the limit defined by MAXMONDOMAIN, something that may otherwise lead to a stack overflow.
tipcmonrcv() is called from the function tipclinkproto_rcv(), where we are reading a 32 bit message data length field into a uint16. To avert any risk of bit overflow, we add an extra sanity check for this in that function. We cannot see that happen with the current code, but future designers being unaware of this risk, may introduce it by allowing delivery of very large (> 64k) sk buffers from the bearer layer. This potential problem was identified by Eric Dumazet.
This fixes CVE-2022-0435
[
{
"target": {
"file": "net/tipc/monitor.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"316044026475441765645739689566437308111",
"105305925760916844380977775504468332600",
"34676647298212733551823301871817496563"
]
},
"deprecated": false,
"id": "CVE-2022-48711-097e7291",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c7e5943553594f68bbc070683db6bb6f6e9e78e"
},
{
"target": {
"file": "net/tipc/monitor.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"316044026475441765645739689566437308111",
"105305925760916844380977775504468332600",
"34676647298212733551823301871817496563"
]
},
"deprecated": false,
"id": "CVE-2022-48711-0aa9e702",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9aa422ad326634b76309e8ff342c246800621216"
},
{
"target": {
"function": "tipc_mon_rcv",
"file": "net/tipc/monitor.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "166829493958349853874589229455408691056",
"length": 1665.0
},
"deprecated": false,
"id": "CVE-2022-48711-105d7700",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9aa422ad326634b76309e8ff342c246800621216"
},
{
"target": {
"file": "net/tipc/link.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"153249649149607133071364804065406420090",
"107319344626158023826933463271102009886",
"284552735088658149315389048395871751009",
"195021491834620186787593797381809078758",
"118677247796746084864118719182337115360",
"69207582761284150689080873866997557368",
"188346081487968699782744573057214340398",
"238591040243782196084031173196115542283"
]
},
"deprecated": false,
"id": "CVE-2022-48711-11699793",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fde4ddeadd099bf9fbb9ccbee8e1b5c20d530a2d"
},
{
"target": {
"function": "tipc_link_proto_rcv",
"file": "net/tipc/link.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "69767487618707388929044811107967624354",
"length": 3401.0
},
"deprecated": false,
"id": "CVE-2022-48711-146c9b2e",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@59ff7514f8c56f166aadca49bcecfa028e0ad50f"
},
{
"target": {
"file": "net/tipc/link.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"153249649149607133071364804065406420090",
"107319344626158023826933463271102009886",
"329770285211957630889022931081257624512",
"12167517876953349822980846235186734247",
"204675865053842950351391238243489873959",
"882498236878497133532467082497841518",
"282566509936520692313131749667502054979",
"311929924258088421888034594271961733628",
"279276957617359421354709656877219335216",
"314674835963875548764325761336818840885",
"3703659941185374971431010855720826182",
"64533274518418908569537185627341910252",
"87225184878014716375186457901289194678",
"115151424485547739973286130547380542306"
]
},
"deprecated": false,
"id": "CVE-2022-48711-341d2c84",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d692e3406e052dbf9f6d9da0cba36cb763272529"
},
{
"target": {
"function": "tipc_mon_rcv",
"file": "net/tipc/monitor.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "146500025455778150837203970002152990351",
"length": 1651.0
},
"deprecated": false,
"id": "CVE-2022-48711-46c6deef",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c7e5943553594f68bbc070683db6bb6f6e9e78e"
},
{
"target": {
"file": "net/tipc/link.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"72999121365340860269408222405061166795",
"304811890703457456311798752782117905452",
"192957533306536377762925317247723818364",
"135870005208693967045424687728781365129",
"183138203768211438397424246154518981529",
"201042184757933248889691170997821801459",
"249850215913897190628867295029205698357",
"3703659941185374971431010855720826182",
"301736797552465306064336039911039815007",
"338523417892937820487167602110440971385",
"231260716194745040266502719068412263084"
]
},
"deprecated": false,
"id": "CVE-2022-48711-4b3701c2",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@59ff7514f8c56f166aadca49bcecfa028e0ad50f"
},
{
"target": {
"file": "net/tipc/monitor.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"316044026475441765645739689566437308111",
"105305925760916844380977775504468332600",
"34676647298212733551823301871817496563"
]
},
"deprecated": false,
"id": "CVE-2022-48711-52e09b65",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fde4ddeadd099bf9fbb9ccbee8e1b5c20d530a2d"
},
{
"target": {
"file": "net/tipc/link.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"153249649149607133071364804065406420090",
"107319344626158023826933463271102009886",
"329770285211957630889022931081257624512",
"90947658998450176354942189422917708525",
"71431524955531536286225502183487432777",
"139919553628871336166589545830596317256",
"69207582761284150689080873866997557368",
"188346081487968699782744573057214340398",
"238591040243782196084031173196115542283"
]
},
"deprecated": false,
"id": "CVE-2022-48711-53333f67",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f1af11edd08dd8376f7a84487cbb0ea8203e3a1d"
},
{
"target": {
"function": "tipc_link_proto_rcv",
"file": "net/tipc/link.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "142491296114128698566067770121309366586",
"length": 2822.0
},
"deprecated": false,
"id": "CVE-2022-48711-5358cf0b",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f1af11edd08dd8376f7a84487cbb0ea8203e3a1d"
},
{
"target": {
"function": "tipc_link_proto_rcv",
"file": "net/tipc/link.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "150565930251909091857698803599995635223",
"length": 2711.0
},
"deprecated": false,
"id": "CVE-2022-48711-570a9c0e",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fde4ddeadd099bf9fbb9ccbee8e1b5c20d530a2d"
},
{
"target": {
"function": "tipc_mon_rcv",
"file": "net/tipc/monitor.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "166829493958349853874589229455408691056",
"length": 1665.0
},
"deprecated": false,
"id": "CVE-2022-48711-5c77b048",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1f1788616157b0222b0c2153828b475d95e374a7"
},
{
"target": {
"function": "tipc_mon_rcv",
"file": "net/tipc/monitor.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "146500025455778150837203970002152990351",
"length": 1651.0
},
"deprecated": false,
"id": "CVE-2022-48711-5f6d24c4",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f1af11edd08dd8376f7a84487cbb0ea8203e3a1d"
},
{
"target": {
"function": "tipc_link_proto_rcv",
"file": "net/tipc/link.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "139624035161404324890124942532654682545",
"length": 2703.0
},
"deprecated": false,
"id": "CVE-2022-48711-779f7499",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@175db196e45d6f0e6047eccd09c8ba55465eb131"
},
{
"target": {
"file": "net/tipc/link.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"72999121365340860269408222405061166795",
"304811890703457456311798752782117905452",
"192957533306536377762925317247723818364",
"135870005208693967045424687728781365129",
"183138203768211438397424246154518981529",
"201042184757933248889691170997821801459",
"249850215913897190628867295029205698357",
"3703659941185374971431010855720826182",
"301736797552465306064336039911039815007",
"338523417892937820487167602110440971385",
"231260716194745040266502719068412263084"
]
},
"deprecated": false,
"id": "CVE-2022-48711-83949f19",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c7e5943553594f68bbc070683db6bb6f6e9e78e"
},
{
"target": {
"file": "net/tipc/monitor.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"316044026475441765645739689566437308111",
"105305925760916844380977775504468332600",
"34676647298212733551823301871817496563"
]
},
"deprecated": false,
"id": "CVE-2022-48711-8905c107",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d692e3406e052dbf9f6d9da0cba36cb763272529"
},
{
"target": {
"function": "tipc_mon_rcv",
"file": "net/tipc/monitor.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "166829493958349853874589229455408691056",
"length": 1665.0
},
"deprecated": false,
"id": "CVE-2022-48711-89ee7cee",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@59ff7514f8c56f166aadca49bcecfa028e0ad50f"
},
{
"target": {
"function": "tipc_link_proto_rcv",
"file": "net/tipc/link.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "69767487618707388929044811107967624354",
"length": 3401.0
},
"deprecated": false,
"id": "CVE-2022-48711-95ae861f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1f1788616157b0222b0c2153828b475d95e374a7"
},
{
"target": {
"file": "net/tipc/link.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"72999121365340860269408222405061166795",
"304811890703457456311798752782117905452",
"192957533306536377762925317247723818364",
"135870005208693967045424687728781365129",
"183138203768211438397424246154518981529",
"201042184757933248889691170997821801459",
"249850215913897190628867295029205698357",
"3703659941185374971431010855720826182",
"301736797552465306064336039911039815007",
"338523417892937820487167602110440971385",
"231260716194745040266502719068412263084"
]
},
"deprecated": false,
"id": "CVE-2022-48711-97267d1d",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9aa422ad326634b76309e8ff342c246800621216"
},
{
"target": {
"function": "tipc_mon_rcv",
"file": "net/tipc/monitor.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "146500025455778150837203970002152990351",
"length": 1651.0
},
"deprecated": false,
"id": "CVE-2022-48711-9a4d7638",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fde4ddeadd099bf9fbb9ccbee8e1b5c20d530a2d"
},
{
"target": {
"function": "tipc_link_proto_rcv",
"file": "net/tipc/link.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "69767487618707388929044811107967624354",
"length": 3401.0
},
"deprecated": false,
"id": "CVE-2022-48711-ac378702",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9aa422ad326634b76309e8ff342c246800621216"
},
{
"target": {
"function": "tipc_link_proto_rcv",
"file": "net/tipc/link.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "69767487618707388929044811107967624354",
"length": 3401.0
},
"deprecated": false,
"id": "CVE-2022-48711-b224e1d3",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c7e5943553594f68bbc070683db6bb6f6e9e78e"
},
{
"target": {
"file": "net/tipc/link.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"153249649149607133071364804065406420090",
"107319344626158023826933463271102009886",
"284552735088658149315389048395871751009",
"195021491834620186787593797381809078758",
"118677247796746084864118719182337115360",
"69207582761284150689080873866997557368",
"188346081487968699782744573057214340398",
"238591040243782196084031173196115542283"
]
},
"deprecated": false,
"id": "CVE-2022-48711-b686ae49",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@175db196e45d6f0e6047eccd09c8ba55465eb131"
},
{
"target": {
"file": "net/tipc/monitor.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"316044026475441765645739689566437308111",
"105305925760916844380977775504468332600",
"34676647298212733551823301871817496563"
]
},
"deprecated": false,
"id": "CVE-2022-48711-b6f0e194",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1f1788616157b0222b0c2153828b475d95e374a7"
},
{
"target": {
"function": "tipc_link_proto_rcv",
"file": "net/tipc/link.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "35728492160704761250619043114255156952",
"length": 3351.0
},
"deprecated": false,
"id": "CVE-2022-48711-c50b6dd1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d692e3406e052dbf9f6d9da0cba36cb763272529"
},
{
"target": {
"file": "net/tipc/link.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"72999121365340860269408222405061166795",
"304811890703457456311798752782117905452",
"192957533306536377762925317247723818364",
"135870005208693967045424687728781365129",
"183138203768211438397424246154518981529",
"201042184757933248889691170997821801459",
"249850215913897190628867295029205698357",
"3703659941185374971431010855720826182",
"301736797552465306064336039911039815007",
"338523417892937820487167602110440971385",
"231260716194745040266502719068412263084"
]
},
"deprecated": false,
"id": "CVE-2022-48711-c54a975a",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1f1788616157b0222b0c2153828b475d95e374a7"
},
{
"target": {
"file": "net/tipc/monitor.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"316044026475441765645739689566437308111",
"105305925760916844380977775504468332600",
"34676647298212733551823301871817496563"
]
},
"deprecated": false,
"id": "CVE-2022-48711-ce067f71",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f1af11edd08dd8376f7a84487cbb0ea8203e3a1d"
},
{
"target": {
"function": "tipc_mon_rcv",
"file": "net/tipc/monitor.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "146500025455778150837203970002152990351",
"length": 1651.0
},
"deprecated": false,
"id": "CVE-2022-48711-d7b6f3cb",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@175db196e45d6f0e6047eccd09c8ba55465eb131"
},
{
"target": {
"file": "net/tipc/monitor.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"316044026475441765645739689566437308111",
"105305925760916844380977775504468332600",
"34676647298212733551823301871817496563"
]
},
"deprecated": false,
"id": "CVE-2022-48711-f247fc45",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@175db196e45d6f0e6047eccd09c8ba55465eb131"
},
{
"target": {
"file": "net/tipc/monitor.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"316044026475441765645739689566437308111",
"105305925760916844380977775504468332600",
"34676647298212733551823301871817496563"
]
},
"deprecated": false,
"id": "CVE-2022-48711-f4f36ba4",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@59ff7514f8c56f166aadca49bcecfa028e0ad50f"
},
{
"target": {
"function": "tipc_mon_rcv",
"file": "net/tipc/monitor.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "146500025455778150837203970002152990351",
"length": 1651.0
},
"deprecated": false,
"id": "CVE-2022-48711-fee44049",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d692e3406e052dbf9f6d9da0cba36cb763272529"
}
]