In the Linux kernel, the following vulnerability has been resolved:
erspan: do not assume transport header is always set
Rewrite tests in ip6erspantunnelxmit() and erspanfbxmit() to not assume transport header is set.
syzbot reported:
WARNING: CPU: 0 PID: 1350 at include/linux/skbuff.h:2911 skbtransportheader include/linux/skbuff.h:2911 [inline] WARNING: CPU: 0 PID: 1350 at include/linux/skbuff.h:2911 ip6erspantunnelxmit+0x15af/0x2eb0 net/ipv6/ip6gre.c:963 Modules linked in: CPU: 0 PID: 1350 Comm: aoetx0 Not tainted 5.19.0-rc2-syzkaller-00160-g274295c6e53f #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 RIP: 0010:skbtransportheader include/linux/skbuff.h:2911 [inline] RIP: 0010:ip6erspantunnelxmit+0x15af/0x2eb0 net/ipv6/ip6gre.c:963 Code: 0f 47 f0 40 88 b5 7f fe ff ff e8 8c 16 4b f9 89 de bf ff ff ff ff e8 a0 12 4b f9 66 83 fb ff 0f 85 1d f1 ff ff e8 71 16 4b f9 <0f> 0b e9 43 f0 ff ff e8 65 16 4b f9 48 8d 85 30 ff ff ff ba 60 00 RSP: 0018:ffffc90005daf910 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 000000000000ffff RCX: 0000000000000000 RDX: ffff88801f032100 RSI: ffffffff882e8d3f RDI: 0000000000000003 RBP: ffffc90005dafab8 R08: 0000000000000003 R09: 000000000000ffff R10: 000000000000ffff R11: 0000000000000000 R12: ffff888024f21d40 R13: 000000000000a288 R14: 00000000000000b0 R15: ffff888025a2e000 FS: 0000000000000000(0000) GS:ffff88802c800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b2e425000 CR3: 000000006d099000 CR4: 0000000000152ef0 Call Trace: <TASK> _netdevstartxmit include/linux/netdevice.h:4805 [inline] netdevstartxmit include/linux/netdevice.h:4819 [inline] xmitone net/core/dev.c:3588 [inline] devhardstartxmit+0x188/0x880 net/core/dev.c:3604 schdirectxmit+0x19f/0xbe0 net/sched/schgeneric.c:342 _devxmitskb net/core/dev.c:3815 [inline] _devqueuexmit+0x14a1/0x3900 net/core/dev.c:4219 devqueuexmit include/linux/netdevice.h:2994 [inline] tx+0x6a/0xc0 drivers/block/aoe/aoenet.c:63 kthread+0x1e7/0x3b0 drivers/block/aoe/aoecmd.c:1229 kthread+0x2e9/0x3a0 kernel/kthread.c:376 retfromfork+0x1f/0x30 arch/x86/entry/entry64.S:302 </TASK>
[
{
"id": "CVE-2022-49691-1f0d7362",
"signature_type": "Line",
"digest": {
"line_hashes": [
"211619188124337624386888952568223008376",
"77213424658715973558015795761190823095",
"6460072452198848931072697634350142642",
"65326016315569782924748778495025576946",
"21760043080430271442517428242770272529",
"321454412009750499439443622205733821941",
"267123912187264790727839375723567900200",
"312223755324103930277937848536325382059",
"317581595964695482741219782266685593384",
"328297692800382092094349116997888557264",
"212856347056607437746944648364252795908"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "net/ipv6/ip6_gre.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@301bd140ed0b24f0da660874c7e8a47dad8c8222",
"deprecated": false
},
{
"id": "CVE-2022-49691-21c1b23b",
"signature_type": "Function",
"digest": {
"length": 2054.0,
"function_hash": "192085884811784346729963818428095687351"
},
"signature_version": "v1",
"target": {
"function": "erspan_fb_xmit",
"file": "net/ipv4/ip_gre.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fb401f37f6eadf24956d93687e5758c163c0d12b",
"deprecated": false
},
{
"id": "CVE-2022-49691-2527e674",
"signature_type": "Function",
"digest": {
"length": 1843.0,
"function_hash": "160825352963825450693460908065842779600"
},
"signature_version": "v1",
"target": {
"function": "erspan_fb_xmit",
"file": "net/ipv4/ip_gre.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a3b2470399f679587c45abe56e551caf10becca2",
"deprecated": false
},
{
"id": "CVE-2022-49691-254ea02f",
"signature_type": "Line",
"digest": {
"line_hashes": [
"101811397544074858747441815049163116525",
"222194668050883326037595836994704056963",
"156880461349270792809209781265829966689",
"73591253949459393699503105147716619703",
"21760043080430271442517428242770272529",
"321454412009750499439443622205733821941",
"267123912187264790727839375723567900200",
"312223755324103930277937848536325382059",
"275698765597803450507336639249948878066",
"197766705654309753556475034824172638201",
"172866469042015321109290320042791202903"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "net/ipv4/ip_gre.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fb401f37f6eadf24956d93687e5758c163c0d12b",
"deprecated": false
},
{
"id": "CVE-2022-49691-30e5a693",
"signature_type": "Line",
"digest": {
"line_hashes": [
"211619188124337624386888952568223008376",
"77213424658715973558015795761190823095",
"6460072452198848931072697634350142642",
"65326016315569782924748778495025576946",
"21760043080430271442517428242770272529",
"321454412009750499439443622205733821941",
"267123912187264790727839375723567900200",
"312223755324103930277937848536325382059",
"317581595964695482741219782266685593384",
"328297692800382092094349116997888557264",
"212856347056607437746944648364252795908"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "net/ipv6/ip6_gre.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@02da602bc2f353dccd9e489a604490034ded941e",
"deprecated": false
},
{
"id": "CVE-2022-49691-40af3fab",
"signature_type": "Function",
"digest": {
"length": 3821.0,
"function_hash": "32116691942727418560419419600075460346"
},
"signature_version": "v1",
"target": {
"function": "ip6erspan_tunnel_xmit",
"file": "net/ipv6/ip6_gre.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cec9867ee55478ef5dcb2adf030fe0c442a4c4ee",
"deprecated": false
},
{
"id": "CVE-2022-49691-46bb8a34",
"signature_type": "Function",
"digest": {
"length": 3760.0,
"function_hash": "107813133688596349061588478597171673039"
},
"signature_version": "v1",
"target": {
"function": "ip6erspan_tunnel_xmit",
"file": "net/ipv6/ip6_gre.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fb401f37f6eadf24956d93687e5758c163c0d12b",
"deprecated": false
},
{
"id": "CVE-2022-49691-4c7e481c",
"signature_type": "Line",
"digest": {
"line_hashes": [
"101811397544074858747441815049163116525",
"222194668050883326037595836994704056963",
"156880461349270792809209781265829966689",
"73591253949459393699503105147716619703",
"21760043080430271442517428242770272529",
"321454412009750499439443622205733821941",
"267123912187264790727839375723567900200",
"312223755324103930277937848536325382059",
"275698765597803450507336639249948878066",
"197766705654309753556475034824172638201",
"172866469042015321109290320042791202903"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "net/ipv4/ip_gre.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@02da602bc2f353dccd9e489a604490034ded941e",
"deprecated": false
},
{
"id": "CVE-2022-49691-536b4df9",
"signature_type": "Line",
"digest": {
"line_hashes": [
"101811397544074858747441815049163116525",
"222194668050883326037595836994704056963",
"156880461349270792809209781265829966689",
"73591253949459393699503105147716619703",
"21760043080430271442517428242770272529",
"321454412009750499439443622205733821941",
"267123912187264790727839375723567900200",
"312223755324103930277937848536325382059",
"275698765597803450507336639249948878066",
"197766705654309753556475034824172638201",
"172866469042015321109290320042791202903"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "net/ipv4/ip_gre.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c8aeffc7c586d53e1d380f010bdca4f710f2480",
"deprecated": false
},
{
"id": "CVE-2022-49691-53f77038",
"signature_type": "Line",
"digest": {
"line_hashes": [
"211619188124337624386888952568223008376",
"77213424658715973558015795761190823095",
"6460072452198848931072697634350142642",
"65326016315569782924748778495025576946",
"21760043080430271442517428242770272529",
"321454412009750499439443622205733821941",
"267123912187264790727839375723567900200",
"312223755324103930277937848536325382059",
"317581595964695482741219782266685593384",
"328297692800382092094349116997888557264",
"212856347056607437746944648364252795908"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "net/ipv6/ip6_gre.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c8aeffc7c586d53e1d380f010bdca4f710f2480",
"deprecated": false
},
{
"id": "CVE-2022-49691-6031be22",
"signature_type": "Line",
"digest": {
"line_hashes": [
"101811397544074858747441815049163116525",
"222194668050883326037595836994704056963",
"156880461349270792809209781265829966689",
"73591253949459393699503105147716619703",
"21760043080430271442517428242770272529",
"321454412009750499439443622205733821941",
"267123912187264790727839375723567900200",
"312223755324103930277937848536325382059",
"275698765597803450507336639249948878066",
"197766705654309753556475034824172638201",
"172866469042015321109290320042791202903"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "net/ipv4/ip_gre.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a3b2470399f679587c45abe56e551caf10becca2",
"deprecated": false
},
{
"id": "CVE-2022-49691-64411141",
"signature_type": "Line",
"digest": {
"line_hashes": [
"211619188124337624386888952568223008376",
"77213424658715973558015795761190823095",
"6460072452198848931072697634350142642",
"65326016315569782924748778495025576946",
"21760043080430271442517428242770272529",
"321454412009750499439443622205733821941",
"267123912187264790727839375723567900200",
"312223755324103930277937848536325382059",
"317581595964695482741219782266685593384",
"328297692800382092094349116997888557264",
"212856347056607437746944648364252795908"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "net/ipv6/ip6_gre.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cec9867ee55478ef5dcb2adf030fe0c442a4c4ee",
"deprecated": false
},
{
"id": "CVE-2022-49691-6989dbf4",
"signature_type": "Function",
"digest": {
"length": 1831.0,
"function_hash": "257884663601005361531903040959827362031"
},
"signature_version": "v1",
"target": {
"function": "erspan_fb_xmit",
"file": "net/ipv4/ip_gre.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@02da602bc2f353dccd9e489a604490034ded941e",
"deprecated": false
},
{
"id": "CVE-2022-49691-6c638f2f",
"signature_type": "Line",
"digest": {
"line_hashes": [
"211619188124337624386888952568223008376",
"77213424658715973558015795761190823095",
"6460072452198848931072697634350142642",
"65326016315569782924748778495025576946",
"21760043080430271442517428242770272529",
"321454412009750499439443622205733821941",
"267123912187264790727839375723567900200",
"312223755324103930277937848536325382059",
"317581595964695482741219782266685593384",
"328297692800382092094349116997888557264",
"212856347056607437746944648364252795908"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "net/ipv6/ip6_gre.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fb401f37f6eadf24956d93687e5758c163c0d12b",
"deprecated": false
},
{
"id": "CVE-2022-49691-6d059faf",
"signature_type": "Function",
"digest": {
"length": 3821.0,
"function_hash": "32116691942727418560419419600075460346"
},
"signature_version": "v1",
"target": {
"function": "ip6erspan_tunnel_xmit",
"file": "net/ipv6/ip6_gre.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c8aeffc7c586d53e1d380f010bdca4f710f2480",
"deprecated": false
},
{
"id": "CVE-2022-49691-774545bd",
"signature_type": "Function",
"digest": {
"length": 1843.0,
"function_hash": "160825352963825450693460908065842779600"
},
"signature_version": "v1",
"target": {
"function": "erspan_fb_xmit",
"file": "net/ipv4/ip_gre.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cec9867ee55478ef5dcb2adf030fe0c442a4c4ee",
"deprecated": false
},
{
"id": "CVE-2022-49691-8642f9fc",
"signature_type": "Function",
"digest": {
"length": 1843.0,
"function_hash": "160825352963825450693460908065842779600"
},
"signature_version": "v1",
"target": {
"function": "erspan_fb_xmit",
"file": "net/ipv4/ip_gre.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@301bd140ed0b24f0da660874c7e8a47dad8c8222",
"deprecated": false
},
{
"id": "CVE-2022-49691-aaa04fa7",
"signature_type": "Line",
"digest": {
"line_hashes": [
"101811397544074858747441815049163116525",
"222194668050883326037595836994704056963",
"156880461349270792809209781265829966689",
"73591253949459393699503105147716619703",
"21760043080430271442517428242770272529",
"321454412009750499439443622205733821941",
"267123912187264790727839375723567900200",
"312223755324103930277937848536325382059",
"275698765597803450507336639249948878066",
"197766705654309753556475034824172638201",
"172866469042015321109290320042791202903"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "net/ipv4/ip_gre.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@301bd140ed0b24f0da660874c7e8a47dad8c8222",
"deprecated": false
},
{
"id": "CVE-2022-49691-aca0b949",
"signature_type": "Function",
"digest": {
"length": 3821.0,
"function_hash": "32116691942727418560419419600075460346"
},
"signature_version": "v1",
"target": {
"function": "ip6erspan_tunnel_xmit",
"file": "net/ipv6/ip6_gre.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@301bd140ed0b24f0da660874c7e8a47dad8c8222",
"deprecated": false
},
{
"id": "CVE-2022-49691-c8ddea37",
"signature_type": "Function",
"digest": {
"length": 3821.0,
"function_hash": "32116691942727418560419419600075460346"
},
"signature_version": "v1",
"target": {
"function": "ip6erspan_tunnel_xmit",
"file": "net/ipv6/ip6_gre.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a3b2470399f679587c45abe56e551caf10becca2",
"deprecated": false
},
{
"id": "CVE-2022-49691-d43827d1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"101811397544074858747441815049163116525",
"222194668050883326037595836994704056963",
"156880461349270792809209781265829966689",
"73591253949459393699503105147716619703",
"21760043080430271442517428242770272529",
"321454412009750499439443622205733821941",
"267123912187264790727839375723567900200",
"312223755324103930277937848536325382059",
"275698765597803450507336639249948878066",
"197766705654309753556475034824172638201",
"172866469042015321109290320042791202903"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "net/ipv4/ip_gre.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cec9867ee55478ef5dcb2adf030fe0c442a4c4ee",
"deprecated": false
},
{
"id": "CVE-2022-49691-ea27830c",
"signature_type": "Function",
"digest": {
"length": 3806.0,
"function_hash": "133210440707054089609855872703162058840"
},
"signature_version": "v1",
"target": {
"function": "ip6erspan_tunnel_xmit",
"file": "net/ipv6/ip6_gre.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@02da602bc2f353dccd9e489a604490034ded941e",
"deprecated": false
},
{
"id": "CVE-2022-49691-eca3d34e",
"signature_type": "Function",
"digest": {
"length": 1843.0,
"function_hash": "160825352963825450693460908065842779600"
},
"signature_version": "v1",
"target": {
"function": "erspan_fb_xmit",
"file": "net/ipv4/ip_gre.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c8aeffc7c586d53e1d380f010bdca4f710f2480",
"deprecated": false
},
{
"id": "CVE-2022-49691-f3412b24",
"signature_type": "Line",
"digest": {
"line_hashes": [
"211619188124337624386888952568223008376",
"77213424658715973558015795761190823095",
"6460072452198848931072697634350142642",
"65326016315569782924748778495025576946",
"21760043080430271442517428242770272529",
"321454412009750499439443622205733821941",
"267123912187264790727839375723567900200",
"312223755324103930277937848536325382059",
"317581595964695482741219782266685593384",
"328297692800382092094349116997888557264",
"212856347056607437746944648364252795908"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "net/ipv6/ip6_gre.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a3b2470399f679587c45abe56e551caf10becca2",
"deprecated": false
}
]