CVE-2022-48651

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ipvlan: Fix out-of-bound bugs caused by unset skb->mac_header

If an AF_PACKET socket is used to send packets through ipvlan and the

default xmit function of the AF_PACKET socket is changed from

dev_queue_xmit() to packet_direct_xmit() via setsockopt() with the option

name of PACKET_QDISC_BYPASS, the skb->mac_header may not be reset and

remains as the initial value of 65535, this may trigger slab-out-of-bounds

bugs as following:

=================================================================

UG: KASAN: slab-out-of-bounds in ipvlan_xmit_mode_l2+0xdb/0x330 [ipvlan]

PU: 2 PID: 1768 Comm: raw_send Kdump: loaded Not tainted 6.0.0-rc4+ #6

ardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33

all Trace:

print_address_description.constprop.0+0x1d/0x160

print_report.cold+0x4f/0x112

kasan_report+0xa3/0x130

ipvlan_xmit_mode_l2+0xdb/0x330 [ipvlan]

ipvlan_start_xmit+0x29/0xa0 [ipvlan]

__dev_direct_xmit+0x2e2/

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References