CVE-2022-49234
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2022-49234
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-49234.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2022-49234
- Downstream
- Published
- 2025-02-26T01:55:59Z
- Modified
- 2025-10-21T09:24:03.389736Z
- Summary
- net: dsa: Avoid cross-chip syncing of VLAN filtering
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
net: dsa: Avoid cross-chip syncing of VLAN filtering
Changes to VLAN filtering are not applicable to cross-chip notifications.
On a system like this:
.-----. .-----. .-----. | sw1 +---+ sw2 +---+ sw3 | '-1-2-' '-1-2-' '-1-2-'
Before this change, upon sw1p1 leaving a bridge, a call to dsaportvlan_filtering would also be made to sw2p1 and sw3p1.
In this scenario:
.---------. .-----. .-----. | sw1 +---+ sw2 +---+ sw3 | '-1-2-3-4-' '-1-2-' '-1-2-'
When sw1p4 would leave a bridge, dsaportvlan_filtering would be called for sw2 and sw3 with a non-existing port - leading to array out-of-bounds accesses and crashes on mv88e6xxx.
- References
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedd371b7c92d190448f3ccbf082c90bf929285f648Fixede1f2a4dd8d433eec393d09273a78a3d3551339cf
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedd371b7c92d190448f3ccbf082c90bf929285f648Fixed108dc8741c203e9d6ce4e973367f1bac20c7192b
Affected versions
v5.*
v5.1
v5.1-rc7
v5.10
v5.10-rc1
v5.10-rc2
v5.10-rc3
v5.10-rc4
v5.10-rc5
v5.10-rc6
v5.10-rc7
v5.11
v5.11-rc1
v5.11-rc2
v5.11-rc3
v5.11-rc4
v5.11-rc5
v5.11-rc6
v5.11-rc7
v5.12
v5.12-rc1
v5.12-rc1-dontuse
v5.12-rc2
v5.12-rc3
v5.12-rc4
v5.12-rc5
v5.12-rc6
v5.12-rc7
v5.12-rc8
v5.13
v5.13-rc1
v5.13-rc2
v5.13-rc3
v5.13-rc4
v5.13-rc5
v5.13-rc6
v5.13-rc7
v5.14
v5.14-rc1
v5.14-rc2
v5.14-rc3
v5.14-rc4
v5.14-rc5
v5.14-rc6
v5.14-rc7
v5.15
v5.15-rc1
v5.15-rc2
v5.15-rc3
v5.15-rc4
v5.15-rc5
v5.15-rc6
v5.15-rc7
v5.16
v5.16-rc1
v5.16-rc2
v5.16-rc3
v5.16-rc4
v5.16-rc5
v5.16-rc6
v5.16-rc7
v5.16-rc8
v5.17
v5.17-rc1
v5.17-rc2
v5.17-rc3
v5.17-rc4
v5.17-rc5
v5.17-rc6
v5.17-rc7
v5.17-rc8
v5.17.1
v5.2
v5.2-rc1
v5.2-rc2
v5.2-rc3
v5.2-rc4
v5.2-rc5
v5.2-rc6
v5.2-rc7
v5.3
v5.3-rc1
v5.3-rc2
v5.3-rc3
v5.3-rc4
v5.3-rc5
v5.3-rc6
v5.3-rc7
v5.3-rc8
v5.4
v5.4-rc1
v5.4-rc2
v5.4-rc3
v5.4-rc4
v5.4-rc5
v5.4-rc6
v5.4-rc7
v5.4-rc8
v5.5
v5.5-rc1
v5.5-rc2
v5.5-rc3
v5.5-rc4
v5.5-rc5
v5.5-rc6
v5.5-rc7
v5.6
v5.6-rc1
v5.6-rc2
v5.6-rc3
v5.6-rc4
v5.6-rc5
v5.6-rc6
v5.6-rc7
v5.7
v5.7-rc1
v5.7-rc2
v5.7-rc3
v5.7-rc4
v5.7-rc5
v5.7-rc6
v5.7-rc7
v5.8
v5.8-rc1
v5.8-rc2
v5.8-rc3
v5.8-rc4
v5.8-rc5
v5.8-rc6
v5.8-rc7
v5.9
v5.9-rc1
v5.9-rc2
v5.9-rc3
v5.9-rc4
v5.9-rc5
v5.9-rc6
v5.9-rc7
v5.9-rc8
Database specific
vanir_signatures
[
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@108dc8741c203e9d6ce4e973367f1bac20c7192b",
"deprecated": false,
"id": "CVE-2022-49234-6825979f",
"target": {
"file": "net/dsa/switch.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"72491325651662770034184783924494467275",
"284642372898960029053980541546948383209",
"34034714824972842744254508236535150982",
"61661377128369735227466871228075315116",
"191382478294649715825899384355427232736",
"27531148344808130748387468851058538514"
]
},
"signature_type": "Line"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@108dc8741c203e9d6ce4e973367f1bac20c7192b",
"deprecated": false,
"id": "CVE-2022-49234-94632e64",
"target": {
"function": "dsa_switch_bridge_leave",
"file": "net/dsa/switch.c"
},
"digest": {
"function_hash": "234863718485398920145909501107360707966",
"length": 649.0
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e1f2a4dd8d433eec393d09273a78a3d3551339cf",
"deprecated": false,
"id": "CVE-2022-49234-ca83a198",
"target": {
"function": "dsa_switch_bridge_leave",
"file": "net/dsa/switch.c"
},
"digest": {
"function_hash": "234863718485398920145909501107360707966",
"length": 649.0
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e1f2a4dd8d433eec393d09273a78a3d3551339cf",
"deprecated": false,
"id": "CVE-2022-49234-e42813b9",
"target": {
"file": "net/dsa/switch.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"72491325651662770034184783924494467275",
"284642372898960029053980541546948383209",
"34034714824972842744254508236535150982",
"61661377128369735227466871228075315116",
"191382478294649715825899384355427232736",
"27531148344808130748387468851058538514"
]
},
"signature_type": "Line"
}
]