CVE-2022-48711
tipc: improve size validations for received domain records
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
In the Linux kernel, the following vulnerability has been resolved:
tipc: improve size validations for received domain records
The function tipc_mon_rcv() allows a node to receive and process
domain_record structs from peer nodes to track their views of the
network topology.
This patch verifies that the number of members in a received domain
record does not exceed the limit defined by MAX_MON_DOMAIN, something
that may otherwise lead to a stack overflow.
tipc_mon_rcv() is called from the function tipc_link_proto_rcv(), where
we are reading a 32 bit message data length field into a uint16. To
avert any risk of bit overflow, we add an extra sanity check for this in
that function. We cannot see that happen with the current code, but
future designers being unaware of this risk, may introduce it by
allowing delivery of very large (> 64k) sk buffers from the bearer
layer. This potential problem was identified by Eric Dumazet.
This fixes CVE-2022-0435
En el kernel de Linux, se resolvió la siguiente vulnerabilidad: tipc: mejorar las validaciones de tamaño para los registros de dominio recibidos. La función tipc_mon_rcv() permite que un nodo reciba y procese estructuras domain_record de nodos pares para rastrear sus vistas de la topología de la red. Este parche verifica que la cantidad de miembros en un registro de dominio recibido no exceda el límite definido por MAX_MON_DOMAIN, algo que de otro modo podría provocar un desbordamiento de pila. tipc_mon_rcv() se llama desde la función tipc_link_proto_rcv(), donde leemos un campo de longitud de datos de mensaje de 32 bits en un uint16. Para evitar cualquier riesgo de desbordamiento de bits, agregamos una verificación de cordura adicional en esa función. No podemos ver que eso suceda con el código actual, pero los futuros diseñadores, al desconocer este riesgo, pueden introducirlo permitiendo la entrega de búferes sk muy grandes (> 64k) desde la capa portadora. Este problema potencial fue identificado por Eric Dumazet. Esto corrige CVE-2022-0435
CVSS Scores
SSVC
- Decision:Track
Timeline
- 2024-06-20 CVE Reserved
- 2024-06-20 CVE Published
- 2024-06-21 EPSS Updated
- 2024-08-03 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
CAPEC
References (9)
| URL | Tag | Source |
|---|---|---|
| https://git.kernel.org/stable/c/35c55c9877f8de0ab129fa1a309271d0ecc868b9 | Vuln. Introduced |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 4.8 < 4.9.301 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.8 < 4.9.301" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 4.8 < 4.14.266 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.8 < 4.14.266" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 4.8 < 4.19.229 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.8 < 4.19.229" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 4.8 < 5.4.179 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.8 < 5.4.179" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 4.8 < 5.10.100 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.8 < 5.10.100" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 4.8 < 5.15.23 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.8 < 5.15.23" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 4.8 < 5.16.9 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.8 < 5.16.9" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 4.8 < 5.17 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.8 < 5.17" | en |
Affected
| ||||||