CVE - CVE-2022-49340

CVE-ID
CVE-2022-49340	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
In the Linux kernel, the following vulnerability has been resolved: ip_gre: test csum_start instead of transport header GRE with TUNNEL_CSUM will apply local checksum offload on CHECKSUM_PARTIAL packets. ipgre_xmit must validate csum_start after an optional skb_pull, else lco_csum may trigger an overflow. The original check was if (csum && skb_checksum_start(skb) < skb->data) return -EINVAL; This had false positives when skb_checksum_start is undefined: when ip_summed is not CHECKSUM_PARTIAL. A discussed refinement was straightforward if (csum && skb->ip_summed == CHECKSUM_PARTIAL && skb_checksum_start(skb) < skb->data) return -EINVAL; But was eventually revised more thoroughly: - restrict the check to the only branch where needed, in an uncommon GRE path that uses header_ops and calls skb_pull. - test skb_transport_header, which is set along with csum_start in skb_partial_csum_set in the normal header_ops datapath. Turns out skbs can arrive in this branch without the transport header set, e.g., through BPF redirection. Revise the check back to check csum_start directly, and only if CHECKSUM_PARTIAL. Do leave the check in the updated location. Check field regardless of whether TUNNEL_CSUM is configured.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://git.kernel.org/stable/c/0c92d813c7c9ca2212ecd879232e7d87362fce98 URL:https://git.kernel.org/stable/c/0c92d813c7c9ca2212ecd879232e7d87362fce98 MISC:https://git.kernel.org/stable/c/0ffa268724656633af5f37a38c212326d98ebe8c URL:https://git.kernel.org/stable/c/0ffa268724656633af5f37a38c212326d98ebe8c MISC:https://git.kernel.org/stable/c/3d08bc3a5d9b2106f5c8bcf1adb73147824aa006 URL:https://git.kernel.org/stable/c/3d08bc3a5d9b2106f5c8bcf1adb73147824aa006 MISC:https://git.kernel.org/stable/c/7596bd7920985f7fc8579a92e48bc53ce4475b21 URL:https://git.kernel.org/stable/c/7596bd7920985f7fc8579a92e48bc53ce4475b21 MISC:https://git.kernel.org/stable/c/8d21e9963bec1aad2280cdd034c8993033ef2948 URL:https://git.kernel.org/stable/c/8d21e9963bec1aad2280cdd034c8993033ef2948 MISC:https://git.kernel.org/stable/c/e6b6f98fc7605c06c0a3baa70f62c534d7b4ce58 URL:https://git.kernel.org/stable/c/e6b6f98fc7605c06c0a3baa70f62c534d7b4ce58 MISC:https://git.kernel.org/stable/c/fbeb8dfa8b87ef259eef0c89e39b53962a3cf604 URL:https://git.kernel.org/stable/c/fbeb8dfa8b87ef259eef0c89e39b53962a3cf604
Assigning CNA
kernel.org
Date Record Created
20250226	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20250226)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)