CVE-2022-49092

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: ipv4: fix route with nexthop object delete warning

FRR folks have hit a kernel warning[1] while deleting routes[2] which is

caused by trying to delete a route pointing to a nexthop id without

specifying nhid but matching on an interface. That is, a route is found

but we hit a warning while matching it. The warning is from

fib_info_nh() in include/net/nexthop.h because we run it on a fib_info

with nexthop object. The call chain is:

inet_rtm_delroute -> fib_table_delete -> fib_nh_match (called with a

nexthop fib_info and also with fc_oif set thus calling fib_info_nh on

the fib_info and triggering the warning). The fix is to not do any

matching in that branch if the fi has a nexthop object because those are

managed separately. I.e. we should match when deleting without nh spec and

should fail when deleting a nexthop route with old-style nh spec because

nexthop objects are managed separately, e.g.:

$ ip r show 1.2

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References