CVE-2022-50073

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null

Fixes a NULL pointer derefence bug triggered from tap driver.

When tap_get_user calls virtio_net_hdr_to_skb the skb->dev is null

(in tap.c skb->dev is set after the call to virtio_net_hdr_to_skb)

virtio_net_hdr_to_skb calls dev_parse_header_protocol which

needs skb->dev field to be valid.

The line that trigers the bug is in dev_parse_header_protocol

(dev is at offset 0x10 from skb and is stored in RAX register)

if (!dev->header_ops || !dev->header_ops->parse_protocol)

22e1: mov 0x10(%rbx),%rax

22e5: mov 0x230(%rax),%rax

Setting skb->dev before the call in tap.c fixes the issue.

BUG: kernel NULL pointer dereference, address: 0000000000000230

RIP: 0010:virtio_net_hdr_to_skb.constprop.0+0x335/0x410 [tap]

Code: c0 0f 85 b7 fd ff ff eb d4 41 39 c6 77 cf 29 c6 48 89 df 44 01 f6 e8 7a 79 83 c1 48 85 c0 0f 85 d9 fd ff ff eb

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References