FKIE_CVE-2022-49808

Vulnerability from fkie_nvd - Published: 2025-05-01 15:16 - Updated: 2026-06-17 05:19
Severity
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: net: dsa: don't leak tagger-owned storage on switch driver unbind In the initial commit dc452a471dba ("net: dsa: introduce tagger-owned storage for private and shared data"), we had a call to tag_ops->disconnect(dst) issued from dsa_tree_free(), which is called at tree teardown time. There were problems with connecting to a switch tree as a whole, so this got reworked to connecting to individual switches within the tree. In this process, tag_ops->disconnect(ds) was made to be called only from switch.c (cross-chip notifiers emitted as a result of dynamic tag proto changes), but the normal driver teardown code path wasn't replaced with anything. Solve this problem by adding a function that does the opposite of dsa_switch_setup_tag_protocol(), which is called from the equivalent spot in dsa_switch_teardown(). The positioning here also ensures that we won't have any use-after-free in tagging protocol (*rcv) ops, since the teardown sequence is as follows: dsa_tree_teardown -> dsa_tree_teardown_master -> dsa_master_teardown -> unsets master->dsa_ptr, making no further packets match the ETH_P_XDSA packet type handler -> dsa_tree_teardown_ports -> dsa_port_teardown -> dsa_slave_destroy -> unregisters DSA net devices, there is even a synchronize_net() in unregister_netdevice_many() -> dsa_tree_teardown_switches -> dsa_switch_teardown -> dsa_switch_teardown_tag_protocol -> finally frees the tagger-owned storage
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/4e0c19fcb8b5323716140fa82b79aa9f60e60407Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/5809fb03942dbac25144db5bebea84fa003ecacaPatch
Impacted products
Vendor Product Version
linux linux_kernel *
linux linux_kernel 6.1
linux linux_kernel 6.1
linux linux_kernel 6.1
linux linux_kernel 6.1
linux linux_kernel 6.1
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/dsa/dsa2.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5809fb03942dbac25144db5bebea84fa003ecaca",
              "status": "affected",
              "version": "7f2973149c22e7a6fee4c0c9fa6b8e4108e9c208",
              "versionType": "git"
            },
            {
              "lessThan": "4e0c19fcb8b5323716140fa82b79aa9f60e60407",
              "status": "affected",
              "version": "7f2973149c22e7a6fee4c0c9fa6b8e4108e9c208",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/dsa/dsa2.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "88695986-D3E6-4EA8-89A8-C813D1E588AB",
              "versionEndExcluding": "6.0.10",
              "versionStartIncluding": "5.17",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "E7E331DA-1FB0-4DEC-91AC-7DA69D461C11",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "17F0B248-42CF-4AE6-A469-BB1BAE7F4705",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*",
              "matchCriteriaId": "E2422816-0C14-4B5E-A1E6-A9D776E5C49B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*",
              "matchCriteriaId": "1C6E00FE-5FB9-4D20-A1A1-5A32128F9B76",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc5:*:*:*:*:*:*",
              "matchCriteriaId": "35B26BE4-43A6-4A36-A7F6-5B3F572D9186",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: don\u0027t leak tagger-owned storage on switch driver unbind\n\nIn the initial commit dc452a471dba (\"net: dsa: introduce tagger-owned\nstorage for private and shared data\"), we had a call to\ntag_ops-\u003edisconnect(dst) issued from dsa_tree_free(), which is called at\ntree teardown time.\n\nThere were problems with connecting to a switch tree as a whole, so this\ngot reworked to connecting to individual switches within the tree. In\nthis process, tag_ops-\u003edisconnect(ds) was made to be called only from\nswitch.c (cross-chip notifiers emitted as a result of dynamic tag proto\nchanges), but the normal driver teardown code path wasn\u0027t replaced with\nanything.\n\nSolve this problem by adding a function that does the opposite of\ndsa_switch_setup_tag_protocol(), which is called from the equivalent\nspot in dsa_switch_teardown(). The positioning here also ensures that we\nwon\u0027t have any use-after-free in tagging protocol (*rcv) ops, since the\nteardown sequence is as follows:\n\ndsa_tree_teardown\n-\u003e dsa_tree_teardown_master\n   -\u003e dsa_master_teardown\n      -\u003e unsets master-\u003edsa_ptr, making no further packets match the\n         ETH_P_XDSA packet type handler\n-\u003e dsa_tree_teardown_ports\n   -\u003e dsa_port_teardown\n      -\u003e dsa_slave_destroy\n         -\u003e unregisters DSA net devices, there is even a synchronize_net()\n            in unregister_netdevice_many()\n-\u003e dsa_tree_teardown_switches\n   -\u003e dsa_switch_teardown\n      -\u003e dsa_switch_teardown_tag_protocol\n         -\u003e finally frees the tagger-owned storage"
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: dsa: no filtrar almacenamiento propiedad del etiquetador al desvincular el controlador del conmutador. En la confirmaci\u00f3n inicial dc452a471dba (\"net: dsa: introducir almacenamiento propiedad del etiquetador para datos privados y compartidos\"), ten\u00edamos una llamada a tag_ops-\u0026gt;disconnect(dst) emitida desde dsa_tree_free(), que se llama en el momento del desmontaje del \u00e1rbol. Hab\u00eda problemas con la conexi\u00f3n a un \u00e1rbol de conmutadores como un todo, por lo que esto se modific\u00f3 para conectarse a conmutadores individuales dentro del \u00e1rbol. En este proceso, tag_ops-\u0026gt;disconnect(ds) se hizo para que se llamara solo desde switch.c (notificadores entre chips emitidos como resultado de cambios din\u00e1micos de protocolo de etiqueta), pero la ruta de c\u00f3digo normal para el desmontaje del controlador no se reemplaz\u00f3 con nada. Resuelva este problema a\u00f1adiendo una funci\u00f3n que haga lo contrario de dsa_switch_setup_tag_protocol(), que se llama desde el punto equivalente en dsa_switch_teardown(). El posicionamiento aqu\u00ed tambi\u00e9n asegura que no tendremos ning\u00fan use-after-free en las operaciones del protocolo de etiquetado (*rcv), ya que la secuencia de desmontaje es la siguiente: dsa_tree_teardown -\u0026gt; dsa_tree_teardown_master -\u0026gt; dsa_master_teardown -\u0026gt; anula el ajuste master-\u0026gt;dsa_ptr, lo que hace que no haya m\u00e1s paquetes que coincidan con el controlador de tipo de paquete ETH_P_XDSA -\u0026gt; dsa_tree_teardown_ports -\u0026gt; dsa_port_teardown -\u0026gt; dsa_slave_destroy -\u0026gt; anula el registro de los dispositivos de red DSA, incluso hay un synchronize_net() en unregister_netdevice_many() -\u0026gt; dsa_tree_teardown_switches -\u0026gt; dsa_switch_teardown -\u0026gt; dsa_switch_teardown_tag_protocol -\u0026gt; finalmente libera el almacenamiento propiedad del etiquetador"
    }
  ],
  "id": "CVE-2022-49808",
  "lastModified": "2026-06-17T05:19:11.760",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2025-05-01T15:16:04.130",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/4e0c19fcb8b5323716140fa82b79aa9f60e60407"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/5809fb03942dbac25144db5bebea84fa003ecaca"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.