CVE-2022-49871

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-49871
In the Linux kernel, the following vulnerability has been resolved: net: tun: Fix memory leaks of napi_get_frags kmemleak reports after running test_progs: unreferenced object 0xffff8881b1672dc0 (size 232): comm "test_progs", pid 394388, jiffies 4354712116 (age 841.975s) hex dump (first 32 bytes): e0 84 d7 a8 81 88 ff ff 80 2c 67 b1 81 88 ff ff .........,g..... 00 40 c5 9b 81 88 ff ff 00 00 00 00 00 00 00 00 .@.............. backtrace: [<00000000c8f01748>] napi_skb_cache_get+0xd4/0x150 [<0000000041c7fc09>] __napi_build_skb+0x15/0x50 [<00000000431c7079>] __napi_alloc_skb+0x26e/0x540 [<000000003ecfa30e>] napi_get_frags+0x59/0x140 [<0000000099b2199e>] tun_get_user+0x183d/0x3bb0 [tun] [<000000008a5adef0>] tun_chr_write_iter+0xc0/0x1b1 [tun] [<0000000049993ff4>] do_iter_readv_writev+0x19f/0x320 [<000000008f338ea2>] do_iter_write+0x135/0x630 [<000000008a3377a4>] vfs_writev+0x12e/0x440 [<00000000a6b5639a>] do_writev+0x104/0x280 [<00000000ccf065d8>] do_syscall_64+0x3b/0x90 [<00000000d776e329>] entry_SYSCALL_64_after_hwframe+0x63/0xcd The issue occurs in the following scenarios: tun_get_user() napi_gro_frags() napi_frags_finish() case GRO_NORMAL: gro_normal_one() list_add_tail(&skb->list, &napi->rx_list); <-- While napi->rx_count < READ_ONCE(gro_normal_batch), <-- gro_normal_list() is not called, napi->rx_list is not empty <-- not ask to complete the gro work, will cause memory leaks in <-- following tun_napi_del() ... tun_napi_del() netif_napi_del() __netif_napi_del() <-- &napi->rx_list is not empty, which caused memory leaks To fix, add napi_complete() after napi_gro_frags().

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/1118b2049d77ca0b505775fc1a8d1909cf19a7ec Patch
https://git.kernel.org/stable/c/223ef6a94e52331a6a7ef31e59921e0e82d2d40a Patch
https://git.kernel.org/stable/c/3401f964028ac941425b9b2c8ff8a022539ef44a Patch
https://git.kernel.org/stable/c/8b12a020b20a78f62bedc50f26db3bf4fadf8cb9 Patch
https://git.kernel.org/stable/c/a4f73f6adc53fd7a3f9771cbc89a03ef39b0b755 Patch
https://git.kernel.org/stable/c/d7569302a7a52a9305d2fb054df908ff985553bb Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*
History

07 May 2025, 13:22

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
First Time Linux linux Kernel
Linux
CWE CWE-401
References () https://git.kernel.org/stable/c/1118b2049d77ca0b505775fc1a8d1909cf19a7ec - () https://git.kernel.org/stable/c/1118b2049d77ca0b505775fc1a8d1909cf19a7ec - Patch
References () https://git.kernel.org/stable/c/223ef6a94e52331a6a7ef31e59921e0e82d2d40a - () https://git.kernel.org/stable/c/223ef6a94e52331a6a7ef31e59921e0e82d2d40a - Patch
References () https://git.kernel.org/stable/c/3401f964028ac941425b9b2c8ff8a022539ef44a - () https://git.kernel.org/stable/c/3401f964028ac941425b9b2c8ff8a022539ef44a - Patch
References () https://git.kernel.org/stable/c/8b12a020b20a78f62bedc50f26db3bf4fadf8cb9 - () https://git.kernel.org/stable/c/8b12a020b20a78f62bedc50f26db3bf4fadf8cb9 - Patch
References () https://git.kernel.org/stable/c/a4f73f6adc53fd7a3f9771cbc89a03ef39b0b755 - () https://git.kernel.org/stable/c/a4f73f6adc53fd7a3f9771cbc89a03ef39b0b755 - Patch
References () https://git.kernel.org/stable/c/d7569302a7a52a9305d2fb054df908ff985553bb - () https://git.kernel.org/stable/c/d7569302a7a52a9305d2fb054df908ff985553bb - Patch

02 May 2025, 13:52

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: tun: Se corrigen las fugas de memoria de napi_get_frags que informa kmemleak tras ejecutar test_progs: objeto sin referencia 0xffff8881b1672dc0 (tamaño 232): comm "test_progs", pid 394388, jiffies 4354712116 (edad 841,975 s) volcado hexadecimal (primeros 32 bytes): e0 84 d7 a8 81 88 ff ff 80 2c 67 b1 81 88 ff ff .........,g..... 00 40 c5 9b 81 88 ff ff 00 00 00 00 00 00 00 00 .@.............. backtrace: [&lt;00000000c8f01748&gt;] napi_skb_cache_get+0xd4/0x150 [&lt;0000000041c7fc09&gt;] __napi_build_skb+0x15/0x50 [&lt;00000000431c7079&gt;] __napi_alloc_skb+0x26e/0x540 [&lt;000000003ecfa30e&gt;] napi_get_frags+0x59/0x140 [&lt;0000000099b2199e&gt;] tun_get_user+0x183d/0x3bb0 [tun] [&lt;000000008a5adef0&gt;] tun_chr_write_iter+0xc0/0x1b1 [tun] El problema ocurre en los siguientes escenarios: tun_get_user() napi_gro_frags() napi_frags_finish() caso GRO_NORMAL: gro_normal_one() list_add_tail(&amp;skb-&gt;list, &amp;napi-&gt;rx_list); &lt;-- Mientras napi-&gt;rx_count &lt; READ_ONCE(gro_normal_batch), &lt;-- gro_normal_list() no se llama, napi-&gt;rx_list no está vacío &lt;-- no solicita completar el trabajo de gro, causará pérdidas de memoria en &lt;-- siguientes tun_napi_del() ... tun_napi_del() netif_napi_del() __netif_napi_del() &lt;-- &amp;napi-&gt;rx_list no está vacío, lo que causó pérdidas de memoria Para corregirlo, agregue napi_complete() después de napi_gro_frags().

01 May 2025, 15:16

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-01 15:16

Updated : 2025-05-07 13:22

NVD link : CVE-2022-49871

Mitre link : CVE-2022-49871

CVE.ORG link : CVE-2022-49871

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-401

Missing Release of Memory after Effective Lifetime