CVE-2022-49862

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tipc: fix the msg->req tlv len check in tipc_nl_compat_name_table_dump_header

This is a follow-up for commit 974cb0e3e7c9 ("tipc: fix uninit-value

in tipc_nl_compat_name_table_dump") where it should have type casted

sizeof(..) to int to work when TLV_GET_DATA_LEN() returns a negative

value.

syzbot reported a call trace because of it:

BUG: KMSAN: uninit-value in ...

tipc_nl_compat_name_table_dump+0x841/0xea0 net/tipc/netlink_compat.c:934

__tipc_nl_compat_dumpit+0xab2/0x1320 net/tipc/netlink_compat.c:238

tipc_nl_compat_dumpit+0x991/0xb50 net/tipc/netlink_compat.c:321

tipc_nl_compat_recv+0xb6e/0x1640 net/tipc/netlink_compat.c:1324

genl_family_rcv_msg_doit net/netlink/genetlink.c:731 [inline]

genl_family_rcv_msg net/netlink/genetlink.c:775 [inline]

genl_rcv_msg+0x103f/0x1260 net/netlink/genetlink.c:792

netlink_rcv_skb+0x3a5/0x6c0 net/netlink/af_netlink.c:2501

genl_rcv+0x3c/0x50 net/netlink/

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References