CVE-2022-49973

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

skmsg: Fix wrong last sg check in sk_msg_recvmsg()

Fix one kernel NULL pointer dereference as below:

[ 224.462334] Call Trace:

[ 224.462394] __tcp_bpf_recvmsg+0xd3/0x380

[ 224.462441] ? sock_has_perm+0x78/0xa0

[ 224.462463] tcp_bpf_recvmsg+0x12e/0x220

[ 224.462494] inet_recvmsg+0x5b/0xd0

[ 224.462534] __sys_recvfrom+0xc8/0x130

[ 224.462574] ? syscall_trace_enter+0x1df/0x2e0

[ 224.462606] ? __do_page_fault+0x2de/0x500

[ 224.462635] __x64_sys_recvfrom+0x24/0x30

[ 224.462660] do_syscall_64+0x5d/0x1d0

[ 224.462709] entry_SYSCALL_64_after_hwframe+0x65/0xca

In commit 9974d37ea75f ("skmsg: Fix invalid last sg check in

sk_msg_recvmsg()"), we change last sg check to sg_is_last(),

but in sockmap redirection case (without stream_parser/stream_verdict/

skb_verdict), we did not mark the end of the scatterlist. Check the

sk_msg_alloc, sk_msg_page_add, and bpf_msg_push_data functions, they all

do not mark the

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References