CVE-2022-49663

published 2025-02-26

CVE-2022-49663: In the Linux kernel, the following vulnerability has been resolved: tunnels: do not assume mac header is set in skb_tunnel_check_pmtu() Recently added debug in…

Priority P4 22 medium 5.5 CVSS 3.1

AV L AC L PR L UI N S U C N I N A H

In the Linux kernel, the following vulnerability has been resolved:

tunnels: do not assume mac header is set in skb_tunnel_check_pmtu()

Recently added debug in commit f9aefd6b2aa3 ("net: warn if mac header
was not set") caught a bug in skb_tunnel_check_pmtu(), as shown
in this syzbot report [1].

In ndo_start_xmit() paths, there is really no need to use skb->mac_header,
because skb->data is supposed to point at it.

[1] WARNING: CPU: 1 PID: 8604 at include/linux/skbuff.h:2784 skb_mac_header_len include/linux/skbuff.h:2784 [inline]
WARNING: CPU: 1 PID: 8604 at include/linux/skbuff.h:2784 skb_tunnel_check_pmtu+0x5de/0x2f90 net/ipv4/ip_tunnel_core.c:413
Modules linked in:
CPU: 1 PID: 8604 Comm: syz-executor.3 Not tainted 5.19.0-rc2-syzkaller-00443-g8720bd951b8e #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:skb_mac_header_len include/linux/skbuff.h:2784 [inline]
RIP: 0010:skb_tunnel_check_pmtu+0x5de/0x2f90 net/ipv4/ip_tunnel_core.c:413
Code: 00 00 00 00 fc ff df 4c 89 fa 48 c1 ea 03 80 3c 02 00 0f 84 b9 fe ff ff 4c 89 ff e8 7c 0f d7 f9 e9 ac fe ff ff e8 c2 13 8a f9 0b e9 28 fc ff ff e8 b6 13 8a f9 48 8b 54 24 70 48 b8 00 00 00
RSP: 0018:ffffc90002e4f520 EFLAGS: 00010212
RAX: 0000000000000324 RBX: ffff88804d5fd500 RCX: ffffc90005b52000
RDX: 0000000000040000 RSI: ffffffff87f05e3e RDI: 0000000000000003
RBP: ffffc90002e4f650 R08: 0000000000000003 R09: 000000000000ffff
R10: 000000000000ffff R11: 0000000000000000 R12: 000000000000ffff
R13: 0000000000000000 R14: 000000000000ffcd R15: 000000000000001f
FS: 00007f3babba9700(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000080 CR3: 0000000075319000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:

geneve_xmit_skb drivers/net/geneve.c:927 [inline]
geneve_xmit+0xcf8/0x35d0 drivers/net/gen

Affected

14 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 5.18.14-1 (bookworm)	linux 5.18.14-1 (bookworm)
linux	linux	—	—
linux	linux	>= 4cb47a8644cc9eb8ec81190a50e79e6530d0297f < 59c51c3b545128a92ebfb6dbae990d3abee110e7	59c51c3b545128a92ebfb6dbae990d3abee110e7
linux	linux	>= 4cb47a8644cc9eb8ec81190a50e79e6530d0297f < 674a641e5b67e16ba3112eacd680ff87b38539de	674a641e5b67e16ba3112eacd680ff87b38539de
linux	linux	>= 4cb47a8644cc9eb8ec81190a50e79e6530d0297f < 32dcf62efa0003f92a976aea0c57f118e689de8b	32dcf62efa0003f92a976aea0c57f118e689de8b
linux	linux	>= 4cb47a8644cc9eb8ec81190a50e79e6530d0297f < 853a7614880231747040cada91d2b8d2e995c51a	853a7614880231747040cada91d2b8d2e995c51a
linux	linux_kernel	—	—
linux	linux_kernel	>= 0 < 5.10.136-1	5.10.136-1
linux	linux_kernel	>= 0 < 5.18.14-1	5.18.14-1
linux	linux_kernel	>= 0 < 5.18.14-1	5.18.14-1
linux	linux_kernel	>= 0 < 5.18.14-1	5.18.14-1
linux	linux_kernel	>= 5.11 < 5.15.53	5.15.53
linux	linux_kernel	>= 5.16 < 5.18.10	5.18.10
linux	linux_kernel	>= 5.9 < 5.10.129	5.10.129

CVSS provenance

nvd v3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

osv 5.5 MEDIUM

vendor_debian 5.5 MEDIUM

vendor_redhat 5.5 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.