CVE-2022-49048

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix panic when forwarding a pkt with no in6 dev kongweibin reported a kernel panic in ip6forward when input interface has no in6 dev associated. The following tc commands were used to reproduce this panic: tc qdisc del dev...

UBUNTU-CVE-2022-49153

In the Linux kernel, the following vulnerability has been resolved: wireguard: socket: free skb in send6 when ipv6 is disabled I got a memory leak report: unreferenced object 0xffff8881191fc040 size 232: comm "kworker/u17:0", pid 23193, jiffies 4295238848 age 3464.870s hex dump first 32 bytes: 00...

UBUNTU-CVE-2022-49048

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix panic when forwarding a pkt with no in6 dev kongweibin reported a kernel panic in ip6forward when input interface has no in6 dev associated. The following tc commands were used to reproduce this panic: tc qdisc del dev...

CVE-2022-49728 ipv6: Fix signed integer overflow in __ip6_append_data

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix signed integer overflow in ip6appenddata Resurrect ubsan overflow checks and ubsan report this warning, fix it by change the variable length type to sizet. UBSAN: signed-integer-overflow in net/ipv6/ip6output.c:1489:19...

CVE-2022-49728

CVE-2022-49728 affects the Linux kernel’s IPv6 path. The issue is a signed integer overflow in __ip6_append_data, triggered by computing [length] that could exceed int range (UBSAN report: 2147479552 + 8567 cannot be represented in type int). The fix implemented across patches changes the [length...

CVE-2022-49727 ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix signed integer overflow in l2tpip6sendmsg When len = INTMAX - transhdrlen, ulen = len + transhdrlen will be overflow. To fix, we can follow what udpv6 does and subtract the transhdrlen from the max...

CVE-2022-49727

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix signed integer overflow in l2tpip6sendmsg When len = INTMAX - transhdrlen, ulen = len + transhdrlen will be overflow. To fix, we can follow what udpv6 does and subtract the transhdrlen from the max...

CVE-2022-49662 ipv6: fix lockdep splat in in6_dump_addrs()

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix lockdep splat in in6dumpaddrs As reported by syzbot, we should not use rcudereference when rcureadlock is not held. WARNING: suspicious RCU usage 5.19.0-rc2-syzkaller 0 Not tainted net/ipv6/addrconf.c:5175 suspicious...

CVE-2022-49662 ipv6: fix lockdep splat in in6_dump_addrs()

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix lockdep splat in in6dumpaddrs As reported by syzbot, we should not use rcudereference when rcureadlock is not held. WARNING: suspicious RCU usage 5.19.0-rc2-syzkaller 0 Not tainted net/ipv6/addrconf.c:5175 suspicious...

CVE-2022-49662

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix lockdep splat in in6dumpaddrs As reported by syzbot, we should not use rcudereference when rcureadlock is not held. WARNING: suspicious RCU usage 5.19.0-rc2-syzkaller 0 Not tainted net/ipv6/addrconf.c:5175 suspicious...

CVE-2022-49662

CVE-2022-49662 : Linux kernel vulnerability involving a lockdep splat in in6_dump_addrs() due to incorrect use of rcu_dereference() without rcu_read_lock() held. Affects net/ipv6/addrconf.c (illustrated at line ~5175) and is shown in the provided stack trace (in6_dump_addrs → inet6_dump_addr → ne...

CVE-2022-49339 net: ipv6: unexport __init-annotated seg6_hmac_init()

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: unexport init-annotated seg6hmacinit EXPORTSYMBOL and init is a bad combination because the .init.text section is freed up after the initialization. Hence, modules cannot use symbols annotated init. The access to a fre...

CVE-2022-49339

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: unexport init-annotated seg6hmacinit EXPORTSYMBOL and init is a bad combination because the .init.text section is freed up after the initialization. Hence, modules cannot use symbols annotated init. The access to a fre...

CVE-2022-49153

CVE-2022-49153 affects the Linux kernel via the wireguard path: when sending to a peer, skb memory is not freed if IPv6 is disabled, causing a memory leak. The root cause is missing kfree_skb() in the send6() handling within wg_socket_send_buffer_to_peer/..send_buffer_to_peer() and related code p...

CVE-2022-49153 wireguard: socket: free skb in send6 when ipv6 is disabled

In the Linux kernel, the following vulnerability has been resolved: wireguard: socket: free skb in send6 when ipv6 is disabled I got a memory leak report: unreferenced object 0xffff8881191fc040 size 232: comm "kworker/u17:0", pid 23193, jiffies 4295238848 age 3464.870s hex dump first 32 bytes: 00...

CVE-2022-49048 ipv6: fix panic when forwarding a pkt with no in6 dev

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix panic when forwarding a pkt with no in6 dev kongweibin reported a kernel panic in ip6forward when input interface has no in6 dev associated. The following tc commands were used to reproduce this panic: tc qdisc del dev...

CVE-2022-49048

CVE-2022-49048 : In the Linux kernel, a panic was reported in ip6_forward() when the input interface has no in6 dev, which has been fixed. The description/refs indicate the issue arises during IPv6 forwarding and can trigger a kernel panic; reproduction used tc qdisc commands on vxlan100. The con...

CVE-2022-49048

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix panic when forwarding a pkt with no in6 dev kongweibin reported a kernel panic in ip6forward when input interface has no in6 dev associated. The following tc commands were used to reproduce this panic: tc qdisc del dev...

CVE-2022-49048 ipv6: fix panic when forwarding a pkt with no in6 dev

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix panic when forwarding a pkt with no in6 dev kongweibin reported a kernel panic in ip6forward when input interface has no in6 dev associated. The following tc commands were used to reproduce this panic: tc qdisc del dev...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a kernel crash when forwarding packets without in6 dev...