In the Linux kernel, the following vulnerability has been resolved:
bpf: Don't redirect packets with invalid pkt_len
Syzbot found an issue [1]: fqcodeldrop() try to drop a flow whitout any skbs, that is, the flow->head is null. The root cause, as the [2] says, is because that bpfprogtestrunskb() run a bpf prog which redirects empty skbs. So we should determine whether the length of the packet modified by bpf prog or others like bpfprogtest is valid before forwarding it directly.
[ { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fd1894224407c484f652ad456e1ce423e89bb3eb", "target": { "file": "include/linux/skbuff.h" }, "id": "CVE-2022-49975-042c5eeb", "deprecated": false, "signature_type": "Line", "digest": { "line_hashes": [ "214586936230849157789739529726676225185", "307791642686978067844173508333684980566", "279131452598973281392453831539998731742" ], "threshold": 0.9 }, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@72f2dc8993f10262092745a88cb2dd0fef094f23", "target": { "function": "__dev_queue_xmit", "file": "net/core/dev.c" }, "id": "CVE-2022-49975-09b3d028", "deprecated": false, "signature_type": "Function", "digest": { "function_hash": "222080959967111320218632643380818578033", "length": 1856.0 }, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@72f2dc8993f10262092745a88cb2dd0fef094f23", "target": { "file": "net/core/dev.c" }, "id": "CVE-2022-49975-0fd07a61", "deprecated": false, "signature_type": "Line", "digest": { "line_hashes": [ "248264706414869305119192057950230361035", "4280265158126530220297949417098790445", "337837191688291422255648373455225046341", "243080261169709159671745859530201673090" ], "threshold": 0.9 }, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6204bf78b2a903b96ba43afff6abc0b04d6e0462", "target": { "file": "include/linux/skbuff.h" }, "id": "CVE-2022-49975-187d7534", "deprecated": false, "signature_type": "Line", "digest": { "line_hashes": [ "214586936230849157789739529726676225185", "307791642686978067844173508333684980566", "279131452598973281392453831539998731742" ], "threshold": 0.9 }, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@72f2dc8993f10262092745a88cb2dd0fef094f23", "target": { "file": "net/bpf/test_run.c" }, "id": "CVE-2022-49975-268d9f43", "deprecated": false, "signature_type": "Line", "digest": { "line_hashes": [ "110344610425988686257152600319844150982", "298610524698803911962822407685727966811", "11511828596319236759916780796516807353" ], "threshold": 0.9 }, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fd1894224407c484f652ad456e1ce423e89bb3eb", "target": { "file": "net/core/dev.c" }, "id": "CVE-2022-49975-38f7bc35", "deprecated": false, "signature_type": "Line", "digest": { "line_hashes": [ "248264706414869305119192057950230361035", "4280265158126530220297949417098790445", "337837191688291422255648373455225046341", "243080261169709159671745859530201673090" ], "threshold": 0.9 }, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8b68e53d56697a59b5c53893b53f508bbdf272a0", "target": { "function": "__dev_queue_xmit", "file": "net/core/dev.c" }, "id": "CVE-2022-49975-3b5fae95", "deprecated": false, "signature_type": "Function", "digest": { "function_hash": "116285597826103211573257807741856782177", "length": 1624.0 }, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6204bf78b2a903b96ba43afff6abc0b04d6e0462", "target": { "function": "__dev_queue_xmit", "file": "net/core/dev.c" }, "id": "CVE-2022-49975-42322d18", "deprecated": false, "signature_type": "Function", "digest": { "function_hash": "295434765801747259219136286153314665473", "length": 1667.0 }, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8b68e53d56697a59b5c53893b53f508bbdf272a0", "target": { "file": "net/core/dev.c" }, "id": "CVE-2022-49975-4be73c03", "deprecated": false, "signature_type": "Line", "digest": { "line_hashes": [ "248264706414869305119192057950230361035", "4280265158126530220297949417098790445", "266698342322963586795453531871912111057", "20108220279624310014184154564431904262" ], "threshold": 0.9 }, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6204bf78b2a903b96ba43afff6abc0b04d6e0462", "target": { "file": "net/core/dev.c" }, "id": "CVE-2022-49975-4c20a474", "deprecated": false, "signature_type": "Line", "digest": { "line_hashes": [ "248264706414869305119192057950230361035", "4280265158126530220297949417098790445", "266698342322963586795453531871912111057", "20108220279624310014184154564431904262" ], "threshold": 0.9 }, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fd1894224407c484f652ad456e1ce423e89bb3eb", "target": { "function": "convert___skb_to_skb", "file": "net/bpf/test_run.c" }, "id": "CVE-2022-49975-4ef24a3d", "deprecated": false, "signature_type": "Function", "digest": { "function_hash": "21782923447188738826514403761631172239", "length": 1558.0 }, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a75987714bd2d8e59840667a28e15c1fa5c47554", "target": { "file": "include/linux/skbuff.h" }, "id": "CVE-2022-49975-5771ab93", "deprecated": false, "signature_type": "Line", "digest": { "line_hashes": [ "214586936230849157789739529726676225185", "307791642686978067844173508333684980566", "279131452598973281392453831539998731742" ], "threshold": 0.9 }, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8b68e53d56697a59b5c53893b53f508bbdf272a0", "target": { "file": "include/linux/skbuff.h" }, "id": "CVE-2022-49975-5c49da42", "deprecated": false, "signature_type": "Line", "digest": { "line_hashes": [ "214586936230849157789739529726676225185", "307791642686978067844173508333684980566", "279131452598973281392453831539998731742" ], "threshold": 0.9 }, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a75987714bd2d8e59840667a28e15c1fa5c47554", "target": { "file": "net/core/dev.c" }, "id": "CVE-2022-49975-5fa0269c", "deprecated": false, "signature_type": "Line", "digest": { "line_hashes": [ "248264706414869305119192057950230361035", "4280265158126530220297949417098790445", "337837191688291422255648373455225046341", "243080261169709159671745859530201673090" ], "threshold": 0.9 }, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6204bf78b2a903b96ba43afff6abc0b04d6e0462", "target": { "function": "convert___skb_to_skb", "file": "net/bpf/test_run.c" }, "id": "CVE-2022-49975-6fe20dbb", "deprecated": false, "signature_type": "Function", "digest": { "function_hash": "102812266636729092030903053439235989258", "length": 1439.0 }, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@72f2dc8993f10262092745a88cb2dd0fef094f23", "target": { "function": "convert___skb_to_skb", "file": "net/bpf/test_run.c" }, "id": "CVE-2022-49975-7dc67f5c", "deprecated": false, "signature_type": "Function", "digest": { "function_hash": "21782923447188738826514403761631172239", "length": 1558.0 }, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6204bf78b2a903b96ba43afff6abc0b04d6e0462", "target": { "file": "net/bpf/test_run.c" }, "id": "CVE-2022-49975-985e1a55", "deprecated": false, "signature_type": "Line", "digest": { "line_hashes": [ "110344610425988686257152600319844150982", "298610524698803911962822407685727966811", "11511828596319236759916780796516807353" ], "threshold": 0.9 }, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a75987714bd2d8e59840667a28e15c1fa5c47554", "target": { "file": "net/bpf/test_run.c" }, "id": "CVE-2022-49975-98c853bb", "deprecated": false, "signature_type": "Line", "digest": { "line_hashes": [ "110344610425988686257152600319844150982", "298610524698803911962822407685727966811", "11511828596319236759916780796516807353" ], "threshold": 0.9 }, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8b68e53d56697a59b5c53893b53f508bbdf272a0", "target": { "file": "net/bpf/test_run.c" }, "id": "CVE-2022-49975-a1bce9be", "deprecated": false, "signature_type": "Line", "digest": { "line_hashes": [ "110344610425988686257152600319844150982", "298610524698803911962822407685727966811", "212810916406107249208542474729368594315" ], "threshold": 0.9 }, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8b68e53d56697a59b5c53893b53f508bbdf272a0", "target": { "function": "convert___skb_to_skb", "file": "net/bpf/test_run.c" }, "id": "CVE-2022-49975-d30535a4", "deprecated": false, "signature_type": "Function", "digest": { "function_hash": "255174240050541770914368026104743049344", "length": 602.0 }, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fd1894224407c484f652ad456e1ce423e89bb3eb", "target": { "file": "net/bpf/test_run.c" }, "id": "CVE-2022-49975-d5faac4b", "deprecated": false, "signature_type": "Line", "digest": { "line_hashes": [ "110344610425988686257152600319844150982", "298610524698803911962822407685727966811", "11511828596319236759916780796516807353" ], "threshold": 0.9 }, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a75987714bd2d8e59840667a28e15c1fa5c47554", "target": { "function": "__dev_queue_xmit", "file": "net/core/dev.c" }, "id": "CVE-2022-49975-daebd182", "deprecated": false, "signature_type": "Function", "digest": { "function_hash": "316451776117914260456286478856339790431", "length": 1674.0 }, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a75987714bd2d8e59840667a28e15c1fa5c47554", "target": { "function": "convert___skb_to_skb", "file": "net/bpf/test_run.c" }, "id": "CVE-2022-49975-e9771066", "deprecated": false, "signature_type": "Function", "digest": { "function_hash": "102812266636729092030903053439235989258", "length": 1439.0 }, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@72f2dc8993f10262092745a88cb2dd0fef094f23", "target": { "file": "include/linux/skbuff.h" }, "id": "CVE-2022-49975-efc865f8", "deprecated": false, "signature_type": "Line", "digest": { "line_hashes": [ "214586936230849157789739529726676225185", "307791642686978067844173508333684980566", "279131452598973281392453831539998731742" ], "threshold": 0.9 }, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fd1894224407c484f652ad456e1ce423e89bb3eb", "target": { "function": "__dev_queue_xmit", "file": "net/core/dev.c" }, "id": "CVE-2022-49975-f8f0eb14", "deprecated": false, "signature_type": "Function", "digest": { "function_hash": "222080959967111320218632643380818578033", "length": 1856.0 }, "signature_version": "v1" } ]