CVE-2022-48711: tipc: improve size validations for received domain records
In the Linux kernel, the following vulnerability has been resolved:
tipc: improve size validations for received domain records
The function tipcmonrcv() allows a node to receive and process domainrecord structs from peer nodes to track their views of the network topology.
This patch verifies that the number of members in a received domain record does not exceed the limit defined by MAXMONDOMAIN, something that may otherwise lead to a stack overflow.
tipcmonrcv() is called from the function tipclinkprotorcv(), where we are reading a 32 bit message data length field into a uint16. To avert any risk of bit overflow, we add an extra sanity check for this in that function. We cannot see that happen with the current code, but future designers being unaware of this risk, may introduce it by allowing delivery of very large (> 64k) sk buffers from the bearer layer. This potential problem was identified by Eric Dumazet.
This fixes CVE-2022-0435
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel (TIPC)to a version that resolves this vulnerability.Patch CVE-2022-0435 - Configuration
Apply the TIPC fix that adds an extra sanity check in domain_record handling so the number of members in a received domain record (received via tipc_mon_rcv() called from tipc_link_proto_rcv()) does not exceed the limit defined by MAX_MON_DOMAIN to prevent potential stack overflow from very large sk buffers/record sizes.
TIPC (tipc_mon_rcv / tipc_link_proto_rcv) MAX_MON_DOMAIN size validation for received domain_record structs = add sanity check so member count/record size does not exceed limit defined by MAX_MON_DOMAIN
Event History
Frequently Asked Questions
What is the severity of CVE-2022-48711?
The severity of CVE-2022-48711 has been classified as medium due to potential impact on the network topology tracking.
How do I fix CVE-2022-48711?
To fix CVE-2022-48711, update your Linux kernel to a patched version that resolves the size validation issues.
What versions of the Linux kernel are affected by CVE-2022-48711?
CVE-2022-48711 affects multiple versions of the Linux kernel, specifically versions between 4.8 and 5.17-rc3.
Can CVE-2022-48711 lead to any security risks?
Yes, CVE-2022-48711 can lead to security risks by allowing an attacker to exploit improper size validation in domain records.
Is CVE-2022-48711 part of a larger vulnerability group?
CVE-2022-48711 is part of a series of vulnerabilities in the Linux kernel addressing different aspects of network security.