CVE-2022-50073: net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null
In the Linux kernel, the following vulnerability has been resolved:
net: tap: NULL pointer derefence in devparseheaderprotocol when skb->dev is null
Fixes a NULL pointer derefence bug triggered from tap driver. When tapgetuser calls virtionethdrtoskb the skb->dev is null (in tap.c skb->dev is set after the call to virtionethdrtoskb) virtionethdrtoskb calls devparseheaderprotocol which needs skb->dev field to be valid.
The line that trigers the bug is in devparseheaderprotocol (dev is at offset 0x10 from skb and is stored in RAX register) if (!dev->headerops || !dev->headerops->parseprotocol) 22e1: mov 0x10(%rbx),%rax 22e5: mov 0x230(%rax),%rax
Setting skb->dev before the call in tap.c fixes the issue.
BUG: kernel NULL pointer dereference, address: 0000000000000230 RIP: 0010:virtionethdrtoskb.constprop.0+0x335/0x410 [tap] Code: c0 0f 85 b7 fd ff ff eb d4 41 39 c6 77 cf 29 c6 48 89 df 44 01 f6 e8 7a 79 83 c1 48 85 c0 0f 85 d9 fd ff ff eb b7 48 8b 43 10 <48> 8b 80 30 02 00 00 48 85 c0 74 55 48 8b 40 28 48 85 c0 74 4c 48 RSP: 0018:ffffc90005c27c38 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff888298f25300 RCX: 0000000000000010 RDX: 0000000000000005 RSI: ffffc90005c27cb6 RDI: ffff888298f25300 RBP: ffffc90005c27c80 R08: 00000000ffffffea R09: 00000000000007e8 R10: ffff88858ec77458 R11: 0000000000000000 R12: 0000000000000001 R13: 0000000000000014 R14: ffffc90005c27e08 R15: ffffc90005c27cb6 FS: 0000000000000000(0000) GS:ffff88858ec40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000230 CR3: 0000000281408006 CR4: 00000000003706e0 Call Trace: tapgetuser+0x3f1/0x540 [tap] tapsendmsg+0x56/0x362 [tap] ? gettxbufs+0xc2/0x1e0 [vhostnet] handletxcopy+0x114/0x670 [vhostnet] handletx+0xb0/0xe0 [vhostnet] handletxkick+0x15/0x20 [vhostnet] vhostworker+0x7b/0xc0 [vhost] ? vhostvringcallreset+0x40/0x40 [vhost] kthread+0xfa/0x120 ? kthreadcompleteandexit+0x20/0x20 retfromfork+0x1f/0x30
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In tap.c, ensure skb->dev is set before the call to virtio_net_hdr_to_skb (the vulnerability is triggered in dev_parse_header_protocol when tap_get_user calls virtio_net_hdr_to_skb with skb->dev == NULL).
Linux kernel tap driver (tap.c) skb->dev assignment timing = set skb->dev before calling virtio_net_hdr_to_skb
Event History
Frequently Asked Questions
What is the severity of CVE-2022-50073?
CVE-2022-50073 is considered a high severity vulnerability due to its potential to lead to a system crash or denial of service.
How do I fix CVE-2022-50073?
To fix CVE-2022-50073, update to a patched version of the Linux kernel that addresses the NULL pointer dereference issue.
What systems are affected by CVE-2022-50073?
CVE-2022-50073 affects the Linux kernel, specifically instances using the tap driver.
What type of vulnerability is CVE-2022-50073?
CVE-2022-50073 is a NULL pointer dereference vulnerability that can be triggered under certain conditions in the Linux kernel.
Is there a workaround for CVE-2022-50073?
There are no known workarounds for CVE-2022-50073; the best mitigation is to apply the available kernel updates.