In the Linux kernel, the following vulnerability has been resolved:
netfilter: nftables: avoid skb access on nfstolen
When verdict is NF_STOLEN, the skb might have been freed.
When tracing is enabled, this can result in a use-after-free: 1. access to skb->nf_trace 2. access to skb->mark 3. computation of trace id 4. dump of packet payload
To avoid 1, keep a cached copy of skb->nf_trace in the trace state struct. Refresh this copy whenever verdict is != STOLEN.
Avoid 2 by skipping skb->mark access if verdict is STOLEN.
3 is avoided by precomputing the trace id.
Only dump the packet when verdict is not "STOLEN".
[
{
"deprecated": false,
"id": "CVE-2022-49622-047d5561",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e34b9ed96ce3b06c79bf884009b16961ca478f87",
"digest": {
"function_hash": "330482719423693018478356319583688017884",
"length": 251.0
},
"target": {
"function": "nft_trace_init",
"file": "net/netfilter/nf_tables_trace.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2022-49622-19e27fcd",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0016d5d46d7440729a3132f61a8da3bf7f84e2ba",
"digest": {
"function_hash": "66060635111994115686302384484609840522",
"length": 293.0
},
"target": {
"function": "__nft_trace_verdict",
"file": "net/netfilter/nf_tables_core.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2022-49622-24bb2a4a",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0016d5d46d7440729a3132f61a8da3bf7f84e2ba",
"digest": {
"threshold": 0.9,
"line_hashes": [
"164820833715891089430184564785028889275",
"200940400721543839762420151036735805897",
"118113393231762589433366377953713669425",
"54020392689208143623504546745308650516",
"85441613818882597557832833086338323922",
"11812697784434621440681581343628432920",
"239705040021757267959585679731928969780",
"252594741057405697496408856982411658531",
"19462155902581124022434460782969241449",
"156868702792929834528859585034229871725",
"65611644060413813995278861081267931656",
"160414367320171713645363714503034645117"
]
},
"target": {
"file": "include/net/netfilter/nf_tables.h"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2022-49622-24e2ead9",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e34b9ed96ce3b06c79bf884009b16961ca478f87",
"digest": {
"function_hash": "119681140788185333669753154498851536395",
"length": 2562.0
},
"target": {
"function": "nft_trace_notify",
"file": "net/netfilter/nf_tables_trace.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2022-49622-35acf00b",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0016d5d46d7440729a3132f61a8da3bf7f84e2ba",
"digest": {
"function_hash": "269605491729668309442624848586485874471",
"length": 2253.0
},
"target": {
"function": "nft_do_chain",
"file": "net/netfilter/nf_tables_core.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2022-49622-35e5ff49",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e34b9ed96ce3b06c79bf884009b16961ca478f87",
"digest": {
"function_hash": "66060635111994115686302384484609840522",
"length": 293.0
},
"target": {
"function": "__nft_trace_verdict",
"file": "net/netfilter/nf_tables_core.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2022-49622-3e26cecc",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e34b9ed96ce3b06c79bf884009b16961ca478f87",
"digest": {
"function_hash": "269605491729668309442624848586485874471",
"length": 2253.0
},
"target": {
"function": "nft_do_chain",
"file": "net/netfilter/nf_tables_core.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2022-49622-5903d8d8",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e34b9ed96ce3b06c79bf884009b16961ca478f87",
"digest": {
"function_hash": "71292364106710235414886505454262471407",
"length": 214.0
},
"target": {
"function": "nft_trace_packet",
"file": "net/netfilter/nf_tables_core.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2022-49622-610e5b68",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0016d5d46d7440729a3132f61a8da3bf7f84e2ba",
"digest": {
"function_hash": "71292364106710235414886505454262471407",
"length": 214.0
},
"target": {
"function": "nft_trace_packet",
"file": "net/netfilter/nf_tables_core.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2022-49622-76c4c8ef",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e34b9ed96ce3b06c79bf884009b16961ca478f87",
"digest": {
"threshold": 0.9,
"line_hashes": [
"164820833715891089430184564785028889275",
"200940400721543839762420151036735805897",
"118113393231762589433366377953713669425",
"54020392689208143623504546745308650516",
"85441613818882597557832833086338323922",
"11812697784434621440681581343628432920",
"239705040021757267959585679731928969780",
"252594741057405697496408856982411658531",
"19462155902581124022434460782969241449",
"156868702792929834528859585034229871725",
"65611644060413813995278861081267931656",
"160414367320171713645363714503034645117"
]
},
"target": {
"file": "include/net/netfilter/nf_tables.h"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2022-49622-7a6cba36",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e34b9ed96ce3b06c79bf884009b16961ca478f87",
"digest": {
"threshold": 0.9,
"line_hashes": [
"112573555139394341497496207643559392122",
"265018912672193395106970308952311978852",
"266951602148770075296920863563431912544",
"174437108363517973859093196803565065672",
"17677002644239492613511571206489099110",
"138107863240210609169325082741362259925",
"124503076535032389901032250867481441214",
"34698789541638229716428422901493529634",
"331332738799357948562261678428023775000",
"276826460583371861633963282342491336359",
"175664592867271560833418350094017011594",
"204341131149065529181549010560798703288",
"145374939959010136076424949908473977717",
"101386063591314308870872699336182957622",
"68770076623121180900584736020398953379",
"267375781911331498147565612728845830807",
"67402557639863747572015807255895892538",
"140355612406939506687515504277035561965",
"87858885598674333154149937079569089489",
"165732936879055949359753626198748151746",
"45265009341918954828213574831855596116",
"33419016807162284601185579804903038670",
"4008867844914369143196094787050148884",
"234986327914479601709647457761381466352",
"290887436104906707356646474987089784171",
"27104795994654543112660781693195216953",
"121969753021042877103581038353661166792",
"151599107193761269424004443101411981003",
"29390823275584317218944417107030465906",
"123353503012982767612913034618283678006",
"55131440927415274675617751215539317879",
"258546113887812335904528052859572131171",
"228815672884959773405432403592208719057",
"211269168317580140792427002859677601429",
"12635470102639118176488967450408437545",
"244623440397478328830319720785446064363",
"150339330293163503707154501204872381213",
"27736187645930695006544991992042287454",
"160032143339765378266566031260607997739",
"32052844614438474760601650518674840463",
"254767618210901140325905158201504012759",
"170050129539913281595505152867018255036"
]
},
"target": {
"file": "net/netfilter/nf_tables_trace.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2022-49622-959ad7ae",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0016d5d46d7440729a3132f61a8da3bf7f84e2ba",
"digest": {
"threshold": 0.9,
"line_hashes": [
"32806092703404758483965756521800882649",
"260698652475501382684759315798531755620",
"294555209443196156520796894328301697310",
"67639628731641480778203134258453790289",
"320087673500643029714244478067117181866",
"168194400176864880639671762167593745933",
"165328386161619603716715296629591833703",
"189104234499585682790267922995868078654",
"270451213015291951255486753501034006626",
"229961065602964675245193658159508967032",
"81273795513494881375291264235746378517",
"55094196363542917302401432735874600768",
"117113930887454860928512290186484602020",
"46996468251123633801357573371854511615",
"227728038524494311098461850943359987381",
"68941321321663807187290636122673628069",
"225196333380054918580511700844625462912",
"28498120536529437713815178693239141291",
"317355023993589560315082541678532110427",
"154460556756945023019382914666338313923",
"185397923448994712102288621940256555944",
"188046381736330780996061052948756248888",
"216395038589649220358093645214771235788",
"65567061381397010610671765809513087854",
"39854772893343308684456954500758379911",
"310156560240515062752050667798583513303",
"6874233498191789047083140067338474496"
]
},
"target": {
"file": "net/netfilter/nf_tables_core.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2022-49622-a17a6146",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0016d5d46d7440729a3132f61a8da3bf7f84e2ba",
"digest": {
"function_hash": "260693954617491072049851418410466162655",
"length": 246.0
},
"target": {
"function": "__nft_trace_packet",
"file": "net/netfilter/nf_tables_core.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2022-49622-a3fe8d25",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0016d5d46d7440729a3132f61a8da3bf7f84e2ba",
"digest": {
"function_hash": "330482719423693018478356319583688017884",
"length": 251.0
},
"target": {
"function": "nft_trace_init",
"file": "net/netfilter/nf_tables_trace.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2022-49622-a7f8ccc5",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0016d5d46d7440729a3132f61a8da3bf7f84e2ba",
"digest": {
"threshold": 0.9,
"line_hashes": [
"112573555139394341497496207643559392122",
"265018912672193395106970308952311978852",
"266951602148770075296920863563431912544",
"174437108363517973859093196803565065672",
"17677002644239492613511571206489099110",
"138107863240210609169325082741362259925",
"124503076535032389901032250867481441214",
"34698789541638229716428422901493529634",
"331332738799357948562261678428023775000",
"276826460583371861633963282342491336359",
"175664592867271560833418350094017011594",
"204341131149065529181549010560798703288",
"145374939959010136076424949908473977717",
"101386063591314308870872699336182957622",
"68770076623121180900584736020398953379",
"267375781911331498147565612728845830807",
"67402557639863747572015807255895892538",
"140355612406939506687515504277035561965",
"87858885598674333154149937079569089489",
"165732936879055949359753626198748151746",
"45265009341918954828213574831855596116",
"33419016807162284601185579804903038670",
"4008867844914369143196094787050148884",
"234986327914479601709647457761381466352",
"290887436104906707356646474987089784171",
"27104795994654543112660781693195216953",
"121969753021042877103581038353661166792",
"151599107193761269424004443101411981003",
"29390823275584317218944417107030465906",
"123353503012982767612913034618283678006",
"55131440927415274675617751215539317879",
"258546113887812335904528052859572131171",
"228815672884959773405432403592208719057",
"211269168317580140792427002859677601429",
"12635470102639118176488967450408437545",
"244623440397478328830319720785446064363",
"150339330293163503707154501204872381213",
"27736187645930695006544991992042287454",
"160032143339765378266566031260607997739",
"32052844614438474760601650518674840463",
"254767618210901140325905158201504012759",
"170050129539913281595505152867018255036"
]
},
"target": {
"file": "net/netfilter/nf_tables_trace.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2022-49622-bcc367c2",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e34b9ed96ce3b06c79bf884009b16961ca478f87",
"digest": {
"threshold": 0.9,
"line_hashes": [
"32806092703404758483965756521800882649",
"260698652475501382684759315798531755620",
"294555209443196156520796894328301697310",
"67639628731641480778203134258453790289",
"320087673500643029714244478067117181866",
"168194400176864880639671762167593745933",
"165328386161619603716715296629591833703",
"189104234499585682790267922995868078654",
"270451213015291951255486753501034006626",
"229961065602964675245193658159508967032",
"81273795513494881375291264235746378517",
"55094196363542917302401432735874600768",
"117113930887454860928512290186484602020",
"46996468251123633801357573371854511615",
"227728038524494311098461850943359987381",
"68941321321663807187290636122673628069",
"225196333380054918580511700844625462912",
"28498120536529437713815178693239141291",
"317355023993589560315082541678532110427",
"154460556756945023019382914666338313923",
"185397923448994712102288621940256555944",
"188046381736330780996061052948756248888",
"216395038589649220358093645214771235788",
"65567061381397010610671765809513087854",
"39854772893343308684456954500758379911",
"310156560240515062752050667798583513303",
"6874233498191789047083140067338474496"
]
},
"target": {
"file": "net/netfilter/nf_tables_core.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2022-49622-c8975109",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e34b9ed96ce3b06c79bf884009b16961ca478f87",
"digest": {
"function_hash": "260693954617491072049851418410466162655",
"length": 246.0
},
"target": {
"function": "__nft_trace_packet",
"file": "net/netfilter/nf_tables_core.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2022-49622-c9544b27",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e34b9ed96ce3b06c79bf884009b16961ca478f87",
"digest": {
"function_hash": "292207718724879769341015083815186861817",
"length": 211.0
},
"target": {
"function": "trace_fill_id",
"file": "net/netfilter/nf_tables_trace.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2022-49622-f9dae7d3",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0016d5d46d7440729a3132f61a8da3bf7f84e2ba",
"digest": {
"function_hash": "292207718724879769341015083815186861817",
"length": 211.0
},
"target": {
"function": "trace_fill_id",
"file": "net/netfilter/nf_tables_trace.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2022-49622-fd1a52b5",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0016d5d46d7440729a3132f61a8da3bf7f84e2ba",
"digest": {
"function_hash": "119681140788185333669753154498851536395",
"length": 2562.0
},
"target": {
"function": "nft_trace_notify",
"file": "net/netfilter/nf_tables_trace.c"
},
"signature_type": "Function",
"signature_version": "v1"
}
]