CVE-2022-50253

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: make sure skb->len != 0 when redirecting to a tunneling device

syzkaller managed to trigger another case where skb->len == 0

when we enter __dev_queue_xmit:

WARNING: CPU: 0 PID: 2470 at include/linux/skbuff.h:2576 skb_assert_len include/linux/skbuff.h:2576 [inline]

WARNING: CPU: 0 PID: 2470 at include/linux/skbuff.h:2576 __dev_queue_xmit+0x2069/0x35e0 net/core/dev.c:4295

Call Trace:

dev_queue_xmit+0x17/0x20 net/core/dev.c:4406

__bpf_tx_skb net/core/filter.c:2115 [inline]

__bpf_redirect_no_mac net/core/filter.c:2140 [inline]

__bpf_redirect+0x5fb/0xda0 net/core/filter.c:2163

____bpf_clone_redirect net/core/filter.c:2447 [inline]

bpf_clone_redirect+0x247/0x390 net/core/filter.c:2419

bpf_prog_48159a89cb4a9a16+0x59/0x5e

bpf_dispatcher_nop_func include/linux/bpf.h:897 [inline]

__bpf_prog_run include/linux/filter.h:596 [inline]

bpf_prog_run include/linux/filter.h:603 [inline]

bpf_test_run+0x46c/0x890 net/b

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References