In the Linux kernel, the following vulnerability has been resolved:
net: annotate races around sk->skbounddev_if
UDP sendmsg() is lockless, and reads sk->skbounddev_if while this field can be changed by another thread.
Adds minimal annotations to avoid KCSAN splats for UDP. Following patches will add more annotations to potential lockless readers.
BUG: KCSAN: data-race in _ip6datagramconnect / udpv6sendmsg
write to 0xffff888136d47a94 of 4 bytes by task 7681 on cpu 0: __ip6datagramconnect+0x6e2/0x930 net/ipv6/datagram.c:221 ip6_datagramconnect+0x2a/0x40 net/ipv6/datagram.c:272 inetdgramconnect+0x107/0x190 net/ipv4/afinet.c:576 __sysconnectfile net/socket.c:1900 [inline] __sys_connect+0x197/0x1b0 net/socket.c:1917 __dosysconnect net/socket.c:1927 [inline] __sesysconnect net/socket.c:1924 [inline] __x64sysconnect+0x3d/0x50 net/socket.c:1924 dosyscallx64 arch/x86/entry/common.c:50 [inline] dosyscall64+0x2b/0x50 arch/x86/entry/common.c:80 entrySYSCALL64afterhwframe+0x44/0xae
read to 0xffff888136d47a94 of 4 bytes by task 7670 on cpu 1: udpv6sendmsg+0xc60/0x16e0 net/ipv6/udp.c:1436 inet6sendmsg+0x5f/0x80 net/ipv6/afinet6.c:652 socksendmsgnosec net/socket.c:705 [inline] socksendmsg net/socket.c:725 [inline] ____sys_sendmsg+0x39a/0x510 net/socket.c:2413 ___sys_sendmsg net/socket.c:2467 [inline] __sys_sendmmsg+0x267/0x4c0 net/socket.c:2553 __dosyssendmmsg net/socket.c:2582 [inline] __sesyssendmmsg net/socket.c:2579 [inline] __x64syssendmmsg+0x53/0x60 net/socket.c:2579 dosyscallx64 arch/x86/entry/common.c:50 [inline] dosyscall64+0x2b/0x50 arch/x86/entry/common.c:80 entrySYSCALL64afterhwframe+0x44/0xae
value changed: 0x00000000 -> 0xffffff9b
Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 7670 Comm: syz-executor.3 Tainted: G W 5.18.0-rc1-syzkaller-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
I chose to not add Fixes: tag because race has minor consequences and stable teams busy enough.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49420.json",
"cna_assigner": "Linux"
}[
{
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "net/ipv6/udp.c",
"function": "compute_score"
},
"id": "CVE-2022-49420-0336a830",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20b2f61797873a2b18b5ff1a304ad2674fa1e0a5",
"digest": {
"function_hash": "200313247127621520581188719638596411400",
"length": 886.0
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "net/ipv6/udp.c"
},
"id": "CVE-2022-49420-25bc29bc",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c971d2f3548e4f11b1460ac048f5307e4b39fdb",
"digest": {
"line_hashes": [
"299711429879782230056096513185501102675",
"51829043465610244595732272488610850761",
"315452408461793187725851093368130561632",
"258348234953488192474189611457877728003",
"4524577362662627105354115455573948802",
"252438698601327134745024419467714591344",
"137506737215049369561536583231633379843",
"332113706308949864669878254626405539224",
"336918038704976441590293373309128421281",
"177187405997331454408468333667273651318",
"20429496889834619356941604671041997009",
"264761393034595614831940998445532310625",
"234460323253466090687269450490303197422",
"235601806895740851712665380301512934531",
"145776846197230717094815790644059544793",
"223705204587639568755060293786417566464",
"39904360836368821916112790963944090178",
"20176723081987412974672370525111624026",
"258855914586077380916018439232466696792"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "net/ipv6/datagram.c",
"function": "__ip6_datagram_connect"
},
"id": "CVE-2022-49420-2dbb0c0c",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20b2f61797873a2b18b5ff1a304ad2674fa1e0a5",
"digest": {
"function_hash": "170395924975440654993465042597239174013",
"length": 2430.0
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "net/ipv6/datagram.c",
"function": "__ip6_datagram_connect"
},
"id": "CVE-2022-49420-328a587c",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c971d2f3548e4f11b1460ac048f5307e4b39fdb",
"digest": {
"function_hash": "170395924975440654993465042597239174013",
"length": 2430.0
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "net/ipv6/datagram.c"
},
"id": "CVE-2022-49420-3bcc7cad",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c971d2f3548e4f11b1460ac048f5307e4b39fdb",
"digest": {
"line_hashes": [
"264048306322476994293373172098087951814",
"50867945918849331688270221583359360470",
"265735899621507219283692121751575416812",
"177920021355772008376644523981319581215",
"83216774026390126906028766847937562346",
"10012746100388752605421960466171454538",
"66154345619748383767030843137139655705",
"180298637429901490664816785691449092065",
"220021594310571106692199939271365414798",
"63174790539151515816507353220145406334",
"125114316973508389920558113176282031270"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "net/ipv6/udp.c",
"function": "udpv6_sendmsg"
},
"id": "CVE-2022-49420-487e3132",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20b2f61797873a2b18b5ff1a304ad2674fa1e0a5",
"digest": {
"function_hash": "115711720697686369837666202553221434247",
"length": 6790.0
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "include/net/sock.h"
},
"id": "CVE-2022-49420-5096fd82",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c971d2f3548e4f11b1460ac048f5307e4b39fdb",
"digest": {
"line_hashes": [
"182341888770492833979708719996848356424",
"229804088061113493615438529708922380898",
"99993169983191474699188777474787065092",
"126957953084343977114929439414738719493",
"37796208760883884419377112217861234155",
"332233165155814979479081136042517979763",
"93317179559999145437430097172907698072",
"149728019539719393674888117172914337016",
"189623663670671922501276793041430752513"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "net/ipv6/datagram.c",
"function": "ip6_datagram_send_ctl"
},
"id": "CVE-2022-49420-529791d6",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20b2f61797873a2b18b5ff1a304ad2674fa1e0a5",
"digest": {
"function_hash": "128992734219264835309257712155545235227",
"length": 5217.0
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "net/ipv6/udp.c",
"function": "__udp_v6_is_mcast_sock"
},
"id": "CVE-2022-49420-7509e72e",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20b2f61797873a2b18b5ff1a304ad2674fa1e0a5",
"digest": {
"function_hash": "44854395681877227662469478022504807470",
"length": 773.0
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "include/net/ip.h",
"function": "ipcm_init_sk"
},
"id": "CVE-2022-49420-7858985c",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c971d2f3548e4f11b1460ac048f5307e4b39fdb",
"digest": {
"function_hash": "135397730418996906667613477707063228809",
"length": 280.0
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "include/net/ip.h"
},
"id": "CVE-2022-49420-7cc8cce6",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c971d2f3548e4f11b1460ac048f5307e4b39fdb",
"digest": {
"line_hashes": [
"236334214850440250617030625078940358433",
"158155796594956480565204490350232195487",
"555522041842233508451788638790879781",
"125883497239052745890557008440505354860"
],
"threshold": 0.9
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "net/ipv6/datagram.c"
},
"id": "CVE-2022-49420-854230a3",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20b2f61797873a2b18b5ff1a304ad2674fa1e0a5",
"digest": {
"line_hashes": [
"264048306322476994293373172098087951814",
"50867945918849331688270221583359360470",
"265735899621507219283692121751575416812",
"177920021355772008376644523981319581215",
"83216774026390126906028766847937562346",
"10012746100388752605421960466171454538",
"66154345619748383767030843137139655705",
"180298637429901490664816785691449092065",
"220021594310571106692199939271365414798",
"63174790539151515816507353220145406334",
"125114316973508389920558113176282031270"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "net/ipv6/datagram.c",
"function": "ip6_datagram_send_ctl"
},
"id": "CVE-2022-49420-8f49ea53",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c971d2f3548e4f11b1460ac048f5307e4b39fdb",
"digest": {
"function_hash": "128992734219264835309257712155545235227",
"length": 5217.0
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "include/net/sock.h",
"function": "sk_dev_equal_l3scope"
},
"id": "CVE-2022-49420-a3983667",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c971d2f3548e4f11b1460ac048f5307e4b39fdb",
"digest": {
"function_hash": "117132252540372951611011061385155393306",
"length": 284.0
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "net/ipv6/udp.c",
"function": "udpv6_sendmsg"
},
"id": "CVE-2022-49420-a39df648",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c971d2f3548e4f11b1460ac048f5307e4b39fdb",
"digest": {
"function_hash": "115711720697686369837666202553221434247",
"length": 6790.0
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "include/net/sock.h",
"function": "sk_dev_equal_l3scope"
},
"id": "CVE-2022-49420-a6904f20",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20b2f61797873a2b18b5ff1a304ad2674fa1e0a5",
"digest": {
"function_hash": "117132252540372951611011061385155393306",
"length": 284.0
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "include/net/ip.h",
"function": "ipcm_init_sk"
},
"id": "CVE-2022-49420-ad6e5242",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20b2f61797873a2b18b5ff1a304ad2674fa1e0a5",
"digest": {
"function_hash": "135397730418996906667613477707063228809",
"length": 280.0
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "include/net/ip.h"
},
"id": "CVE-2022-49420-c56a2778",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20b2f61797873a2b18b5ff1a304ad2674fa1e0a5",
"digest": {
"line_hashes": [
"236334214850440250617030625078940358433",
"158155796594956480565204490350232195487",
"555522041842233508451788638790879781",
"125883497239052745890557008440505354860"
],
"threshold": 0.9
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "include/net/sock.h"
},
"id": "CVE-2022-49420-c5b3d891",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20b2f61797873a2b18b5ff1a304ad2674fa1e0a5",
"digest": {
"line_hashes": [
"182341888770492833979708719996848356424",
"229804088061113493615438529708922380898",
"99993169983191474699188777474787065092",
"126957953084343977114929439414738719493",
"37796208760883884419377112217861234155",
"332233165155814979479081136042517979763",
"93317179559999145437430097172907698072",
"149728019539719393674888117172914337016",
"189623663670671922501276793041430752513"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "net/ipv6/udp.c",
"function": "__udp_v6_is_mcast_sock"
},
"id": "CVE-2022-49420-ef8d0658",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c971d2f3548e4f11b1460ac048f5307e4b39fdb",
"digest": {
"function_hash": "44854395681877227662469478022504807470",
"length": 773.0
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "net/ipv6/udp.c",
"function": "compute_score"
},
"id": "CVE-2022-49420-efc21a5a",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c971d2f3548e4f11b1460ac048f5307e4b39fdb",
"digest": {
"function_hash": "200313247127621520581188719638596411400",
"length": 886.0
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "net/ipv6/udp.c"
},
"id": "CVE-2022-49420-f03a4b47",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20b2f61797873a2b18b5ff1a304ad2674fa1e0a5",
"digest": {
"line_hashes": [
"299711429879782230056096513185501102675",
"51829043465610244595732272488610850761",
"315452408461793187725851093368130561632",
"258348234953488192474189611457877728003",
"4524577362662627105354115455573948802",
"252438698601327134745024419467714591344",
"137506737215049369561536583231633379843",
"332113706308949864669878254626405539224",
"336918038704976441590293373309128421281",
"177187405997331454408468333667273651318",
"20429496889834619356941604671041997009",
"264761393034595614831940998445532310625",
"234460323253466090687269450490303197422",
"235601806895740851712665380301512934531",
"145776846197230717094815790644059544793",
"223705204587639568755060293786417566464",
"39904360836368821916112790963944090178",
"20176723081987412974672370525111624026",
"258855914586077380916018439232466696792"
],
"threshold": 0.9
}
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-49420.json"