bpf, sockmap: Fix the sk->sk_forward_alloc warning of sk_str…(CVE-2022-49877)

概要

bpf, sockmap: Fix the sk->sk_forward_alloc warning of sk_stream_kill_queues

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

In the Linux kernel, the following vulnerability has been resolved:

bpf, sockmap: Fix the sk->sk_forward_alloc warning of sk_stream_kill_queues

When running test_sockmap selftests, the following warning appears:

WARNING: CPU: 2 PID: 197 at net/core/stream.c:205 sk_stream_kill_queues+0xd3/0xf0
Call Trace:

inet_csk_destroy_sock+0x55/0x110
tcp_rcv_state_process+0xd28/0x1380
? tcp_v4_do_rcv+0x77/0x2c0
tcp_v4_do_rcv+0x77/0x2c0
__release_sock+0x106/0x130
__tcp_close+0x1a7/0x4e0
tcp_close+0x20/0x70
inet_release+0x3c/0x80
__sock_release+0x3a/0xb0
sock_close+0x14/0x20
__fput+0xa3/0x260
task_work_run+0x59/0xb0
exit_to_user_mode_prepare+0x1b3/0x1c0
syscall_exit_to_user_mode+0x19/0x50
do_syscall_64+0x48/0x90
entry_SYSCALL_64_after_hwframe+0x44/0xae

The root case is in commit 84472b436e76 ("bpf, sockmap: Fix more uncharged
while msg has more_data"), where I used msg->sg.size to replace the tosend,
causing breakage:

if (msg->apply_bytes && msg->apply_bytes < tosend)
tosend = psock->apply_bytes;

出典: OSV.dev (Open Source Vulnerabilities) NVD OSV

影響パッケージ

Linux Kernel

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.225"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.5.0"},{"fixed":"5.10.155"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.79"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.0.9"}]}]

ディストリビューション別の修正状況

各ディストリビューションが公開している、この CVE の修正パッケージ

Debian DEBIAN-CVE-2022-49877 linux 修正版: 5.10.158-1
Ubuntu UBUNTU-CVE-2022-49877 linux-hwe-edge

概要

原文の説明

影響パッケージ

ディストリビューション別の修正状況

参照URL