In the Linux kernel, the following vulnerability has been resolved:
net: tap: NULL pointer derefence in devparseheader_protocol when skb->dev is null
Fixes a NULL pointer derefence bug triggered from tap driver. When tapgetuser calls virtionethdrtoskb the skb->dev is null (in tap.c skb->dev is set after the call to virtionethdrtoskb) virtionethdrtoskb calls devparseheader_protocol which needs skb->dev field to be valid.
The line that trigers the bug is in devparseheaderprotocol (dev is at offset 0x10 from skb and is stored in RAX register) if (!dev->headerops || !dev->headerops->parseprotocol) 22e1: mov 0x10(%rbx),%rax 22e5: mov 0x230(%rax),%rax
Setting skb->dev before the call in tap.c fixes the issue.
BUG: kernel NULL pointer dereference, address: 0000000000000230 RIP: 0010:virtionethdrtoskb.constprop.0+0x335/0x410 [tap] Code: c0 0f 85 b7 fd ff ff eb d4 41 39 c6 77 cf 29 c6 48 89 df 44 01 f6 e8 7a 79 83 c1 48 85 c0 0f 85 d9 fd ff ff eb b7 48 8b 43 10 <48> 8b 80 30 02 00 00 48 85 c0 74 55 48 8b 40 28 48 85 c0 74 4c 48 RSP: 0018:ffffc90005c27c38 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff888298f25300 RCX: 0000000000000010 RDX: 0000000000000005 RSI: ffffc90005c27cb6 RDI: ffff888298f25300 RBP: ffffc90005c27c80 R08: 00000000ffffffea R09: 00000000000007e8 R10: ffff88858ec77458 R11: 0000000000000000 R12: 0000000000000001 R13: 0000000000000014 R14: ffffc90005c27e08 R15: ffffc90005c27cb6 FS: 0000000000000000(0000) GS:ffff88858ec40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000230 CR3: 0000000281408006 CR4: 00000000003706e0 Call Trace: tapgetuser+0x3f1/0x540 [tap] tapsendmsg+0x56/0x362 [tap] ? gettxbufs+0xc2/0x1e0 [vhostnet] handletxcopy+0x114/0x670 [vhostnet] handletx+0xb0/0xe0 [vhostnet] handletxkick+0x15/0x20 [vhostnet] vhostworker+0x7b/0xc0 [vhost] ? vhostvringcallreset+0x40/0x40 [vhost] kthread+0xfa/0x120 ? kthreadcompleteandexit+0x20/0x20 retfrom_fork+0x1f/0x30
[
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dd29648fcf69339713f2d25f7014ae905dcdfc18",
"id": "CVE-2022-50073-13bddfc4",
"digest": {
"threshold": 0.9,
"line_hashes": [
"272941247327968264845557229009302901765",
"293093982188336635979100301693613102319",
"4942418060867771944446930440887468483",
"41290939516836953880530197589339702056",
"1935038492162613619440860531324904445",
"27762733814135510407896562890068486013",
"38012302624385511009565509105886355439",
"285570212733536729374872487830589684237",
"32012005901439845127087151773097059982",
"117986271646007951494276660246056852613",
"327957163897487823325736062941485404438",
"191435742923411102691661824299585174290",
"120201007507765498485980508116271078596",
"195877949728060250263776686301240564697",
"132390888263115190576483407959293039177",
"123631892001709167878857471604734435747",
"330696127268454547715137358538996286449",
"260383683022929370674936304764032899667",
"64979697545976691431136964195221106669",
"140864032490780009058125309437346363212",
"100976239617748229911377540579837771182",
"55032766561477656260238863394121076324"
]
},
"target": {
"file": "drivers/net/tap.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dd29648fcf69339713f2d25f7014ae905dcdfc18",
"id": "CVE-2022-50073-3666eb69",
"digest": {
"function_hash": "296896990272701618304714188911153214641",
"length": 2646.0
},
"target": {
"function": "tap_get_user",
"file": "drivers/net/tap.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f61f133f354853bc394ec7d6028adb9b02dd701",
"id": "CVE-2022-50073-44df6a94",
"digest": {
"function_hash": "296896990272701618304714188911153214641",
"length": 2646.0
},
"target": {
"function": "tap_get_user",
"file": "drivers/net/tap.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f61f133f354853bc394ec7d6028adb9b02dd701",
"id": "CVE-2022-50073-f344c03e",
"digest": {
"threshold": 0.9,
"line_hashes": [
"272941247327968264845557229009302901765",
"293093982188336635979100301693613102319",
"4942418060867771944446930440887468483",
"41290939516836953880530197589339702056",
"1935038492162613619440860531324904445",
"27762733814135510407896562890068486013",
"38012302624385511009565509105886355439",
"285570212733536729374872487830589684237",
"32012005901439845127087151773097059982",
"117986271646007951494276660246056852613",
"327957163897487823325736062941485404438",
"191435742923411102691661824299585174290",
"120201007507765498485980508116271078596",
"195877949728060250263776686301240564697",
"132390888263115190576483407959293039177",
"123631892001709167878857471604734435747",
"330696127268454547715137358538996286449",
"260383683022929370674936304764032899667",
"64979697545976691431136964195221106669",
"140864032490780009058125309437346363212",
"100976239617748229911377540579837771182",
"55032766561477656260238863394121076324"
]
},
"target": {
"file": "drivers/net/tap.c"
},
"signature_type": "Line",
"signature_version": "v1"
}
]