In the Linux kernel, the following vulnerability has been resolved:
ipv6: Fix signed integer overflow in _ip6append_data
Resurrect ubsan overflow checks and ubsan report this warning, fix it by change the variable [length] type to size_t.
UBSAN: signed-integer-overflow in net/ipv6/ip6output.c:1489:19 2147479552 + 8567 cannot be represented in type 'int' CPU: 0 PID: 253 Comm: err Not tainted 5.16.0+ #1 Hardware name: linux,dummy-virt (DT) Call trace: dumpbacktrace+0x214/0x230 showstack+0x30/0x78 dumpstacklvl+0xf8/0x118 dumpstack+0x18/0x30 ubsanepilogue+0x18/0x60 handleoverflow+0xd0/0xf0 ubsanhandleaddoverflow+0x34/0x44 _ip6appenddata.isra.48+0x1598/0x1688 ip6appenddata+0x128/0x260 udpv6sendmsg+0x680/0xdd0 inet6sendmsg+0x54/0x90 socksendmsg+0x70/0x88 _syssendmsg+0xe8/0x368 _syssendmsg+0x98/0xe0 _syssendmmsg+0xf4/0x3b8 _arm64syssendmmsg+0x34/0x48 invokesyscall+0x64/0x160 el0svccommon.constprop.4+0x124/0x300 doel0svc+0x44/0xc8 el0svc+0x3c/0x1e8 el0t64synchandler+0x88/0xb0 el0t64sync+0x16c/0x170
Changes since v1: -Change the variable [length] type to unsigned, as Eric Dumazet suggested. Changes since v2: -Don't change exthdrlen type in ip6makeskb, as Paolo Abeni suggested. Changes since v3: -Don't change ulen type in udpv6sendmsg and l2tpip6_sendmsg, as Jakub Kicinski suggested.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f93431c86b631bbca5614c66f966bf3ddb3c2803",
"target": {
"file": "include/net/ipv6.h"
},
"id": "CVE-2022-49728-3a6dd04a",
"deprecated": false,
"digest": {
"line_hashes": [
"246089312943886641185832906500295653562",
"279916583914980624282476218542055620948",
"163614874753587331512618894167563098208",
"164811337244360818102552119486649722786",
"77247559066375055664250049722288723066",
"210474179460131936985165848805757621869",
"66244264043306731216480128655711375137",
"325424046583088657292568431043594115549"
],
"threshold": 0.9
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@84dc940890e91e42898e4443a093281702440abf",
"target": {
"file": "net/ipv6/ip6_output.c"
},
"id": "CVE-2022-49728-6d521304",
"deprecated": false,
"digest": {
"line_hashes": [
"64463163677369472282700250268502587769",
"75325298507983397218330827687300077889",
"162515851824509333203921175926645754828",
"95529766237256886959695406680777146762",
"246089312943886641185832906500295653562",
"279916583914980624282476218542055620948",
"297976948852809252440863762489310811600",
"317144296782489675937320103520564827273",
"77247559066375055664250049722288723066",
"25803566024782255128155804798788569290",
"117366879448250204051166374482409177385",
"31518246101362078069183583927434509027"
],
"threshold": 0.9
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@70549c80fe80ac4e2a22068c76ebebced24f7e74",
"target": {
"file": "include/net/ipv6.h"
},
"id": "CVE-2022-49728-7c302bc0",
"deprecated": false,
"digest": {
"line_hashes": [
"246089312943886641185832906500295653562",
"279916583914980624282476218542055620948",
"163614874753587331512618894167563098208",
"164811337244360818102552119486649722786",
"77247559066375055664250049722288723066",
"279916583914980624282476218542055620948",
"18712392213484096102872717740455370471",
"75783355589312909243259203700077427594"
],
"threshold": 0.9
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f26422eabeb517629568edf8c2dd9c6cb9147584",
"target": {
"file": "include/net/ipv6.h"
},
"id": "CVE-2022-49728-800a78e9",
"deprecated": false,
"digest": {
"line_hashes": [
"246089312943886641185832906500295653562",
"279916583914980624282476218542055620948",
"163614874753587331512618894167563098208",
"164811337244360818102552119486649722786",
"77247559066375055664250049722288723066",
"279916583914980624282476218542055620948",
"18712392213484096102872717740455370471",
"75783355589312909243259203700077427594"
],
"threshold": 0.9
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@70549c80fe80ac4e2a22068c76ebebced24f7e74",
"target": {
"file": "net/ipv6/ip6_output.c"
},
"id": "CVE-2022-49728-b98ac30b",
"deprecated": false,
"digest": {
"line_hashes": [
"64463163677369472282700250268502587769",
"75325298507983397218330827687300077889",
"162515851824509333203921175926645754828",
"95529766237256886959695406680777146762",
"246089312943886641185832906500295653562",
"279916583914980624282476218542055620948",
"297976948852809252440863762489310811600",
"317144296782489675937320103520564827273",
"77247559066375055664250049722288723066",
"279916583914980624282476218542055620948",
"18712392213484096102872717740455370471",
"22274999805773186471582786457344082420"
],
"threshold": 0.9
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@84dc940890e91e42898e4443a093281702440abf",
"target": {
"file": "include/net/ipv6.h"
},
"id": "CVE-2022-49728-bd805876",
"deprecated": false,
"digest": {
"line_hashes": [
"246089312943886641185832906500295653562",
"279916583914980624282476218542055620948",
"163614874753587331512618894167563098208",
"164811337244360818102552119486649722786",
"77247559066375055664250049722288723066",
"210474179460131936985165848805757621869",
"66244264043306731216480128655711375137",
"325424046583088657292568431043594115549"
],
"threshold": 0.9
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f26422eabeb517629568edf8c2dd9c6cb9147584",
"target": {
"file": "net/ipv6/ip6_output.c"
},
"id": "CVE-2022-49728-d1e7e5b8",
"deprecated": false,
"digest": {
"line_hashes": [
"64463163677369472282700250268502587769",
"75325298507983397218330827687300077889",
"162515851824509333203921175926645754828",
"95529766237256886959695406680777146762",
"246089312943886641185832906500295653562",
"279916583914980624282476218542055620948",
"297976948852809252440863762489310811600",
"317144296782489675937320103520564827273",
"77247559066375055664250049722288723066",
"279916583914980624282476218542055620948",
"18712392213484096102872717740455370471",
"22274999805773186471582786457344082420"
],
"threshold": 0.9
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f93431c86b631bbca5614c66f966bf3ddb3c2803",
"target": {
"file": "net/ipv6/ip6_output.c"
},
"id": "CVE-2022-49728-dca97794",
"deprecated": false,
"digest": {
"line_hashes": [
"64463163677369472282700250268502587769",
"75325298507983397218330827687300077889",
"162515851824509333203921175926645754828",
"95529766237256886959695406680777146762",
"246089312943886641185832906500295653562",
"279916583914980624282476218542055620948",
"297976948852809252440863762489310811600",
"317144296782489675937320103520564827273",
"77247559066375055664250049722288723066",
"25803566024782255128155804798788569290",
"117366879448250204051166374482409177385",
"31518246101362078069183583927434509027"
],
"threshold": 0.9
},
"signature_type": "Line",
"signature_version": "v1"
}
]