CVE-2022-50004

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

xfrm: policy: fix metadata dst->dev xmit null pointer dereference

When we try to transmit an skb with metadata_dst attached (i.e. dst->dev

== NULL) through xfrm interface we can hit a null pointer dereference[1]

in xfrmi_xmit2() -> xfrm_lookup_with_ifid() due to the check for a

loopback skb device when there's no policy which dereferences dst->dev

unconditionally. Not having dst->dev can be interepreted as it not being

a loopback device, so just add a check for a null dst_orig->dev.

With this fix xfrm interface's Tx error counters go up as usual.

[1] net-next calltrace captured via netconsole:

BUG: kernel NULL pointer dereference, address: 00000000000000c0

#PF: supervisor read access in kernel mode

#PF: error_code(0x0000) - not-present page

PGD 0 P4D 0

Oops: 0000 [#1] PREEMPT SMP

CPU: 1 PID: 7231 Comm: ping Kdump: loaded Not tainted 5.19.0+ #24

Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References