In the Linux kernel, the following vulnerability has been resolved:
tipc: fix the msg->req tlv len check in tipcnlcompatnametabledumpheader
This is a follow-up for commit 974cb0e3e7c9 ("tipc: fix uninit-value in tipcnlcompatnametabledump") where it should have type casted sizeof(..) to int to work when TLVGETDATALEN() returns a negative value.
syzbot reported a call trace because of it:
BUG: KMSAN: uninit-value in ... tipcnlcompatnametabledump+0x841/0xea0 net/tipc/netlinkcompat.c:934 _tipcnlcompatdumpit+0xab2/0x1320 net/tipc/netlinkcompat.c:238 tipcnlcompatdumpit+0x991/0xb50 net/tipc/netlinkcompat.c:321 tipcnlcompatrecv+0xb6e/0x1640 net/tipc/netlinkcompat.c:1324 genlfamilyrcvmsgdoit net/netlink/genetlink.c:731 [inline] genlfamilyrcvmsg net/netlink/genetlink.c:775 [inline] genlrcvmsg+0x103f/0x1260 net/netlink/genetlink.c:792 netlinkrcvskb+0x3a5/0x6c0 net/netlink/afnetlink.c:2501 genlrcv+0x3c/0x50 net/netlink/genetlink.c:803 netlinkunicastkernel net/netlink/afnetlink.c:1319 [inline] netlinkunicast+0xf3b/0x1270 net/netlink/afnetlink.c:1345 netlinksendmsg+0x1288/0x1440 net/netlink/afnetlink.c:1921 socksendmsgnosec net/socket.c:714 [inline] socksendmsg net/socket.c:734 [inline]
[
{
"id": "CVE-2022-49862-080c5b7c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6cee2c60bd168279852ac7dbe54c2b70d1028644",
"digest": {
"line_hashes": [
"79046599198467593665645024705554028239",
"216159821962293773558677166800348619174",
"333509851020445967510332552605219545773",
"49185174649323058395607684474574082121"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "net/tipc/netlink_compat.c"
}
},
{
"id": "CVE-2022-49862-37b23ff8",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@301caa06091af4d5cf056ac8249cbda4e6029c6a",
"digest": {
"length": 522.0,
"function_hash": "33003338202308948399906686111470463872"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "tipc_nl_compat_name_table_dump_header",
"file": "net/tipc/netlink_compat.c"
}
},
{
"id": "CVE-2022-49862-72e941bf",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@36769b9477491a7af6635863bd950309c1e1b96c",
"digest": {
"line_hashes": [
"79046599198467593665645024705554028239",
"216159821962293773558677166800348619174",
"333509851020445967510332552605219545773",
"49185174649323058395607684474574082121"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "net/tipc/netlink_compat.c"
}
},
{
"id": "CVE-2022-49862-7b66a1b8",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f31dd158580940938f77514b87337a777520185a",
"digest": {
"length": 522.0,
"function_hash": "33003338202308948399906686111470463872"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "tipc_nl_compat_name_table_dump_header",
"file": "net/tipc/netlink_compat.c"
}
},
{
"id": "CVE-2022-49862-81e7af16",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a0ead1d648df9c456baec832b494513ef405949a",
"digest": {
"length": 522.0,
"function_hash": "33003338202308948399906686111470463872"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "tipc_nl_compat_name_table_dump_header",
"file": "net/tipc/netlink_compat.c"
}
},
{
"id": "CVE-2022-49862-9572e53e",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6cee2c60bd168279852ac7dbe54c2b70d1028644",
"digest": {
"length": 522.0,
"function_hash": "33003338202308948399906686111470463872"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "tipc_nl_compat_name_table_dump_header",
"file": "net/tipc/netlink_compat.c"
}
},
{
"id": "CVE-2022-49862-9bb5848e",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f31dd158580940938f77514b87337a777520185a",
"digest": {
"line_hashes": [
"79046599198467593665645024705554028239",
"216159821962293773558677166800348619174",
"333509851020445967510332552605219545773",
"49185174649323058395607684474574082121"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "net/tipc/netlink_compat.c"
}
},
{
"id": "CVE-2022-49862-b66aea51",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@36769b9477491a7af6635863bd950309c1e1b96c",
"digest": {
"length": 522.0,
"function_hash": "33003338202308948399906686111470463872"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "tipc_nl_compat_name_table_dump_header",
"file": "net/tipc/netlink_compat.c"
}
},
{
"id": "CVE-2022-49862-d1724480",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@082707d3df191bf5bb8801d43e4ce3dea39ca173",
"digest": {
"length": 522.0,
"function_hash": "33003338202308948399906686111470463872"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "tipc_nl_compat_name_table_dump_header",
"file": "net/tipc/netlink_compat.c"
}
},
{
"id": "CVE-2022-49862-ddedaf2d",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1c075b192fe41030457cd4a5f7dea730412bca40",
"digest": {
"line_hashes": [
"79046599198467593665645024705554028239",
"216159821962293773558677166800348619174",
"333509851020445967510332552605219545773",
"49185174649323058395607684474574082121"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "net/tipc/netlink_compat.c"
}
},
{
"id": "CVE-2022-49862-e233a850",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@55a253a6753a603e80b95932ca971ba514aa6ce7",
"digest": {
"length": 522.0,
"function_hash": "33003338202308948399906686111470463872"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "tipc_nl_compat_name_table_dump_header",
"file": "net/tipc/netlink_compat.c"
}
},
{
"id": "CVE-2022-49862-e23e3ff9",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@082707d3df191bf5bb8801d43e4ce3dea39ca173",
"digest": {
"line_hashes": [
"79046599198467593665645024705554028239",
"216159821962293773558677166800348619174",
"333509851020445967510332552605219545773",
"49185174649323058395607684474574082121"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "net/tipc/netlink_compat.c"
}
},
{
"id": "CVE-2022-49862-e26c0903",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1c075b192fe41030457cd4a5f7dea730412bca40",
"digest": {
"length": 522.0,
"function_hash": "33003338202308948399906686111470463872"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "tipc_nl_compat_name_table_dump_header",
"file": "net/tipc/netlink_compat.c"
}
},
{
"id": "CVE-2022-49862-ee23f333",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a0ead1d648df9c456baec832b494513ef405949a",
"digest": {
"line_hashes": [
"79046599198467593665645024705554028239",
"216159821962293773558677166800348619174",
"333509851020445967510332552605219545773",
"49185174649323058395607684474574082121"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "net/tipc/netlink_compat.c"
}
},
{
"id": "CVE-2022-49862-fe90ed82",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@55a253a6753a603e80b95932ca971ba514aa6ce7",
"digest": {
"line_hashes": [
"79046599198467593665645024705554028239",
"216159821962293773558677166800348619174",
"333509851020445967510332552605219545773",
"49185174649323058395607684474574082121"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "net/tipc/netlink_compat.c"
}
},
{
"id": "CVE-2022-49862-ffad908f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@301caa06091af4d5cf056ac8249cbda4e6029c6a",
"digest": {
"line_hashes": [
"79046599198467593665645024705554028239",
"216159821962293773558677166800348619174",
"333509851020445967510332552605219545773",
"49185174649323058395607684474574082121"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "net/tipc/netlink_compat.c"
}
}
]