CVE-2022-48711

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tipc: improve size validations for received domain records

The function tipc_mon_rcv() allows a node to receive and process

domain_record structs from peer nodes to track their views of the

network topology.

This patch verifies that the number of members in a received domain

record does not exceed the limit defined by MAX_MON_DOMAIN, something

that may otherwise lead to a stack overflow.

tipc_mon_rcv() is called from the function tipc_link_proto_rcv(), where

we are reading a 32 bit message data length field into a uint16. To

avert any risk of bit overflow, we add an extra sanity check for this in

that function. We cannot see that happen with the current code, but

future designers being unaware of this risk, may introduce it by

allowing delivery of very large (> 64k) sk buffers from the bearer

layer. This potential problem was identified by Eric Dumazet.

This fixes CVE-2022-0435

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References