CVE-2022-49197 (GCVE-0-2022-49197)

Vulnerability from cvelistv5 – Published: 2025-02-26 01:55 – Updated: 2025-05-04 08:32
VLAI?
Title
af_netlink: Fix shift out of bounds in group mask calculation
Summary
In the Linux kernel, the following vulnerability has been resolved: af_netlink: Fix shift out of bounds in group mask calculation When a netlink message is received, netlink_recvmsg() fills in the address of the sender. One of the fields is the 32-bit bitfield nl_groups, which carries the multicast group on which the message was received. The least significant bit corresponds to group 1, and therefore the highest group that the field can represent is 32. Above that, the UB sanitizer flags the out-of-bounds shift attempts. Which bits end up being set in such case is implementation defined, but it's either going to be a wrong non-zero value, or zero, which is at least not misleading. Make the latter choice deterministic by always setting to 0 for higher-numbered multicast groups. To get information about membership in groups >= 32, userspace is expected to use nl_pktinfo control messages[0], which are enabled by NETLINK_PKTINFO socket option. [0] https://lwn.net/Articles/147608/ The way to trigger this issue is e.g. through monitoring the BRVLAN group: # bridge monitor vlan & # ip link add name br type bridge Which produces the following citation: UBSAN: shift-out-of-bounds in net/netlink/af_netlink.c:162:19 shift exponent 32 is too large for 32-bit type 'int'
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: f7fa9b10edbb9391bdd4ec8e8b3d621d0664b198 , < e1c5d46f05aa23d740daae5cd3a6472145afac42 (git)
Affected: f7fa9b10edbb9391bdd4ec8e8b3d621d0664b198 , < ac5883a8890a11c00b32a19949a25d4afeaa2f5a (git)
Affected: f7fa9b10edbb9391bdd4ec8e8b3d621d0664b198 , < f75f4abeec4c04b600a15b50c89a481f1e7435ee (git)
Affected: f7fa9b10edbb9391bdd4ec8e8b3d621d0664b198 , < 41249fff507387c3323b198d0052faed08b14de4 (git)
Affected: f7fa9b10edbb9391bdd4ec8e8b3d621d0664b198 , < b0898362188e05b2202656058cc32d98fabf3bac (git)
Affected: f7fa9b10edbb9391bdd4ec8e8b3d621d0664b198 , < 7409ff6393a67ff9838d0ae1bd102fb5f020d07a (git)
Affected: f7fa9b10edbb9391bdd4ec8e8b3d621d0664b198 , < e8aaf3134bc5e943048eefe9f2ddaabf41d92b1a (git)
Affected: f7fa9b10edbb9391bdd4ec8e8b3d621d0664b198 , < e23e1e981247feb3c7d0236fe58aceb685f234ae (git)
Affected: f7fa9b10edbb9391bdd4ec8e8b3d621d0664b198 , < 0caf6d9922192dd1afa8dc2131abfb4df1443b9f (git)
Create a notification for this product.
    Linux Linux Affected: 2.6.14
Unaffected: 0 , < 2.6.14 (semver)
Unaffected: 4.9.311 , ≤ 4.9.* (semver)
Unaffected: 4.14.276 , ≤ 4.14.* (semver)
Unaffected: 4.19.238 , ≤ 4.19.* (semver)
Unaffected: 5.4.189 , ≤ 5.4.* (semver)
Unaffected: 5.10.110 , ≤ 5.10.* (semver)
Unaffected: 5.15.33 , ≤ 5.15.* (semver)
Unaffected: 5.16.19 , ≤ 5.16.* (semver)
Unaffected: 5.17.2 , ≤ 5.17.* (semver)
Unaffected: 5.18 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netlink/af_netlink.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e1c5d46f05aa23d740daae5cd3a6472145afac42",
              "status": "affected",
              "version": "f7fa9b10edbb9391bdd4ec8e8b3d621d0664b198",
              "versionType": "git"
            },
            {
              "lessThan": "ac5883a8890a11c00b32a19949a25d4afeaa2f5a",
              "status": "affected",
              "version": "f7fa9b10edbb9391bdd4ec8e8b3d621d0664b198",
              "versionType": "git"
            },
            {
              "lessThan": "f75f4abeec4c04b600a15b50c89a481f1e7435ee",
              "status": "affected",
              "version": "f7fa9b10edbb9391bdd4ec8e8b3d621d0664b198",
              "versionType": "git"
            },
            {
              "lessThan": "41249fff507387c3323b198d0052faed08b14de4",
              "status": "affected",
              "version": "f7fa9b10edbb9391bdd4ec8e8b3d621d0664b198",
              "versionType": "git"
            },
            {
              "lessThan": "b0898362188e05b2202656058cc32d98fabf3bac",
              "status": "affected",
              "version": "f7fa9b10edbb9391bdd4ec8e8b3d621d0664b198",
              "versionType": "git"
            },
            {
              "lessThan": "7409ff6393a67ff9838d0ae1bd102fb5f020d07a",
              "status": "affected",
              "version": "f7fa9b10edbb9391bdd4ec8e8b3d621d0664b198",
              "versionType": "git"
            },
            {
              "lessThan": "e8aaf3134bc5e943048eefe9f2ddaabf41d92b1a",
              "status": "affected",
              "version": "f7fa9b10edbb9391bdd4ec8e8b3d621d0664b198",
              "versionType": "git"
            },
            {
              "lessThan": "e23e1e981247feb3c7d0236fe58aceb685f234ae",
              "status": "affected",
              "version": "f7fa9b10edbb9391bdd4ec8e8b3d621d0664b198",
              "versionType": "git"
            },
            {
              "lessThan": "0caf6d9922192dd1afa8dc2131abfb4df1443b9f",
              "status": "affected",
              "version": "f7fa9b10edbb9391bdd4ec8e8b3d621d0664b198",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netlink/af_netlink.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.14"
            },
            {
              "lessThan": "2.6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.311",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.276",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.238",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.311",
                  "versionStartIncluding": "2.6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.276",
                  "versionStartIncluding": "2.6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.238",
                  "versionStartIncluding": "2.6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.189",
                  "versionStartIncluding": "2.6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.110",
                  "versionStartIncluding": "2.6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.33",
                  "versionStartIncluding": "2.6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16.19",
                  "versionStartIncluding": "2.6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.2",
                  "versionStartIncluding": "2.6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18",
                  "versionStartIncluding": "2.6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_netlink: Fix shift out of bounds in group mask calculation\n\nWhen a netlink message is received, netlink_recvmsg() fills in the address\nof the sender. One of the fields is the 32-bit bitfield nl_groups, which\ncarries the multicast group on which the message was received. The least\nsignificant bit corresponds to group 1, and therefore the highest group\nthat the field can represent is 32. Above that, the UB sanitizer flags the\nout-of-bounds shift attempts.\n\nWhich bits end up being set in such case is implementation defined, but\nit\u0027s either going to be a wrong non-zero value, or zero, which is at least\nnot misleading. Make the latter choice deterministic by always setting to 0\nfor higher-numbered multicast groups.\n\nTo get information about membership in groups \u003e= 32, userspace is expected\nto use nl_pktinfo control messages[0], which are enabled by NETLINK_PKTINFO\nsocket option.\n[0] https://lwn.net/Articles/147608/\n\nThe way to trigger this issue is e.g. through monitoring the BRVLAN group:\n\n\t# bridge monitor vlan \u0026\n\t# ip link add name br type bridge\n\nWhich produces the following citation:\n\n\tUBSAN: shift-out-of-bounds in net/netlink/af_netlink.c:162:19\n\tshift exponent 32 is too large for 32-bit type \u0027int\u0027"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T08:32:09.798Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e1c5d46f05aa23d740daae5cd3a6472145afac42"
        },
        {
          "url": "https://git.kernel.org/stable/c/ac5883a8890a11c00b32a19949a25d4afeaa2f5a"
        },
        {
          "url": "https://git.kernel.org/stable/c/f75f4abeec4c04b600a15b50c89a481f1e7435ee"
        },
        {
          "url": "https://git.kernel.org/stable/c/41249fff507387c3323b198d0052faed08b14de4"
        },
        {
          "url": "https://git.kernel.org/stable/c/b0898362188e05b2202656058cc32d98fabf3bac"
        },
        {
          "url": "https://git.kernel.org/stable/c/7409ff6393a67ff9838d0ae1bd102fb5f020d07a"
        },
        {
          "url": "https://git.kernel.org/stable/c/e8aaf3134bc5e943048eefe9f2ddaabf41d92b1a"
        },
        {
          "url": "https://git.kernel.org/stable/c/e23e1e981247feb3c7d0236fe58aceb685f234ae"
        },
        {
          "url": "https://git.kernel.org/stable/c/0caf6d9922192dd1afa8dc2131abfb4df1443b9f"
        }
      ],
      "title": "af_netlink: Fix shift out of bounds in group mask calculation",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49197",
    "datePublished": "2025-02-26T01:55:41.112Z",
    "dateReserved": "2025-02-26T01:49:39.290Z",
    "dateUpdated": "2025-05-04T08:32:09.798Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.