CVE-2022-48644: In the Linux kernel, the following vulnerability has been resolved: net/sched: taprio: avoid disabling offload when it was never enabled In an incredibly…

PriorityP421medium5.5CVSS 3.1

AVLACLPRLUINSUCNINAH

EPSS

0.23%

14.2th percentile

In the Linux kernel, the following vulnerability has been resolved: net/sched: taprio: avoid disabling offload when it was never enabled In an incredibly strange API design decision, qdisc->destroy() gets called even if qdisc->init() never succeeded, not exclusively since commit 87b60cfacf9f ("net_sched: fix error recovery at qdisc creation"), but apparently also earlier (in the case of qdisc_create_dflt()). The taprio qdisc does not fully acknowledge this when it attempts full offload, because it starts off with q->flags = TAPRIO_FLAGS_INVALID in taprio_init(), then it replaces q->flags with TCA_TAPRIO_ATTR_FLAGS parsed from netlink (in taprio_change(), tail called from taprio_init()). But in taprio_destroy(), we call taprio_disable_offload(), and this determines what to do based on FULL_OFFLOAD_IS_ENABLED(q->flags). But looking at the implementation of FULL_OFFLOAD_IS_ENABLED() (a bitwise check of bit 1 in q->flags), it is invalid to call this macro on q->flags when it contains TAPRIO_FLAGS_INVALID, because that is set to U32_MAX, and therefore FULL_OFFLOAD_IS_ENABLED() will return true on an invalid set of flags. As a result, it is possible to crash the kernel if user space forces an error between setting q->flags = TAPRIO_FLAGS_INVALID, and the calling of taprio_enable_offload(). This is because drivers do not expect the offload to be disabled when it was never enabled. The error that we force here is to attach taprio as a non-root qdisc, but instead as child of an mqprio root qdisc: $ tc qdisc add dev swp0 root handle 1: \ mqprio num_tc 8 map 0 1 2 3 4 5 6 7 \ queues 1@0 1@1 1@2 1@3 1@4 1@5 1@6 1@7 hw 0 $ tc qdisc replace dev swp0 parent 1:1 \ taprio num_tc 8 map 0 1 2 3 4 5 6 7 \ queues 1@0 1@1 1@2 1@3 1@4 1@5 1@6 1@7 base-time 0 \ sched-entry S 0x7f 990000 sched-entry S 0x80 100000 \ flags 0x0 clockid CLOCK_TAI Unable to handle kernel paging request at virtual address fffffffffffffff8 [fffffffffffffff8] pgd=0000000000000000, p4d=0000000000000000 Inter

Affected

16 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 6.0.2-1 (bookworm)	linux 6.0.2-1 (bookworm)
linux	linux	—	—
linux	linux	>= 9c66d15646760eb8982242b4531c4d4fd36118fd < d12a1eb07003e597077329767c6aa86a7e972c76	d12a1eb07003e597077329767c6aa86a7e972c76
linux	linux	>= 9c66d15646760eb8982242b4531c4d4fd36118fd < 586def6ebed195f3594a4884f7c5334d0e1ad1bb	586def6ebed195f3594a4884f7c5334d0e1ad1bb
linux	linux	>= 9c66d15646760eb8982242b4531c4d4fd36118fd < f58e43184226e5e9662088ccf1389e424a3a4cbd	f58e43184226e5e9662088ccf1389e424a3a4cbd
linux	linux	>= 9c66d15646760eb8982242b4531c4d4fd36118fd < c7c9c7eb305ab8b4e93e4e4e1b78d8cfcbc26323	c7c9c7eb305ab8b4e93e4e4e1b78d8cfcbc26323
linux	linux	>= 9c66d15646760eb8982242b4531c4d4fd36118fd < db46e3a88a09c5cf7e505664d01da7238cd56c92	db46e3a88a09c5cf7e505664d01da7238cd56c92
linux	linux_kernel	—	—
linux	linux_kernel	>= 0 < 5.10.148-1	5.10.148-1
linux	linux_kernel	>= 0 < 6.0.2-1	6.0.2-1
linux	linux_kernel	>= 0 < 6.0.2-1	6.0.2-1
linux	linux_kernel	>= 0 < 6.0.2-1	6.0.2-1
linux	linux_kernel	>= 5.11 < 5.15.71	5.15.71
linux	linux_kernel	>= 5.16 < 5.19.12	5.19.12
linux	linux_kernel	>= 5.4 < 5.4.215	5.4.215
linux	linux_kernel	>= 5.5 < 5.10.146	5.10.146

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

osv5.5MEDIUM

vendor_debian5.5MEDIUM

vendor_redhat5.5MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.