CVE-2022-50706 (GCVE-0-2022-50706)
Vulnerability from cvelistv5 – Published: 2025-12-24 10:55 – Updated: 2025-12-24 10:55
VLAI?
Title
net/ieee802154: don't warn zero-sized raw_sendmsg()
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/ieee802154: don't warn zero-sized raw_sendmsg()
syzbot is hitting skb_assert_len() warning at __dev_queue_xmit() [1],
for PF_IEEE802154 socket's zero-sized raw_sendmsg() request is hitting
__dev_queue_xmit() with skb->len == 0.
Since PF_IEEE802154 socket's zero-sized raw_sendmsg() request was
able to return 0, don't call __dev_queue_xmit() if packet length is 0.
----------
#include <sys/socket.h>
#include <netinet/in.h>
int main(int argc, char *argv[])
{
struct sockaddr_in addr = { .sin_family = AF_INET, .sin_addr.s_addr = htonl(INADDR_LOOPBACK) };
struct iovec iov = { };
struct msghdr hdr = { .msg_name = &addr, .msg_namelen = sizeof(addr), .msg_iov = &iov, .msg_iovlen = 1 };
sendmsg(socket(PF_IEEE802154, SOCK_RAW, 0), &hdr, 0);
return 0;
}
----------
Note that this might be a sign that commit fd1894224407c484 ("bpf: Don't
redirect packets with invalid pkt_len") should be reverted, for
skb->len == 0 was acceptable for at least PF_IEEE802154 socket.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
8b68e53d56697a59b5c53893b53f508bbdf272a0 , < 4a36de8947794fa21435d1e916e089095f3246a8
(git)
Affected: 6204bf78b2a903b96ba43afff6abc0b04d6e0462 , < 791489a5c56396ddfed75fc525066d4738dace46 (git) Affected: a75987714bd2d8e59840667a28e15c1fa5c47554 , < 34f31a2b667914ab701ca725554a0b447809d7ef (git) Affected: 72f2dc8993f10262092745a88cb2dd0fef094f23 , < df0da3fc131132b6c32a15c4da4ffa3a5aea1af2 (git) Affected: fd1894224407c484f652ad456e1ce423e89bb3eb , < 9974d220c5073d035b5469d1d8ecd71da86c7afd (git) Affected: fd1894224407c484f652ad456e1ce423e89bb3eb , < b12e924a2f5b960373459c8f8a514f887adf5cac (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ieee802154/socket.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4a36de8947794fa21435d1e916e089095f3246a8",
"status": "affected",
"version": "8b68e53d56697a59b5c53893b53f508bbdf272a0",
"versionType": "git"
},
{
"lessThan": "791489a5c56396ddfed75fc525066d4738dace46",
"status": "affected",
"version": "6204bf78b2a903b96ba43afff6abc0b04d6e0462",
"versionType": "git"
},
{
"lessThan": "34f31a2b667914ab701ca725554a0b447809d7ef",
"status": "affected",
"version": "a75987714bd2d8e59840667a28e15c1fa5c47554",
"versionType": "git"
},
{
"lessThan": "df0da3fc131132b6c32a15c4da4ffa3a5aea1af2",
"status": "affected",
"version": "72f2dc8993f10262092745a88cb2dd0fef094f23",
"versionType": "git"
},
{
"lessThan": "9974d220c5073d035b5469d1d8ecd71da86c7afd",
"status": "affected",
"version": "fd1894224407c484f652ad456e1ce423e89bb3eb",
"versionType": "git"
},
{
"lessThan": "b12e924a2f5b960373459c8f8a514f887adf5cac",
"status": "affected",
"version": "fd1894224407c484f652ad456e1ce423e89bb3eb",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ieee802154/socket.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.220",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.150",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.19.*",
"status": "unaffected",
"version": "5.19.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.0.*",
"status": "unaffected",
"version": "6.0.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.220",
"versionStartIncluding": "5.4.212",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.150",
"versionStartIncluding": "5.10.141",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.75",
"versionStartIncluding": "5.15.65",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.19.17",
"versionStartIncluding": "5.19.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.3",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/ieee802154: don\u0027t warn zero-sized raw_sendmsg()\n\nsyzbot is hitting skb_assert_len() warning at __dev_queue_xmit() [1],\nfor PF_IEEE802154 socket\u0027s zero-sized raw_sendmsg() request is hitting\n__dev_queue_xmit() with skb-\u003elen == 0.\n\nSince PF_IEEE802154 socket\u0027s zero-sized raw_sendmsg() request was\nable to return 0, don\u0027t call __dev_queue_xmit() if packet length is 0.\n\n ----------\n #include \u003csys/socket.h\u003e\n #include \u003cnetinet/in.h\u003e\n\n int main(int argc, char *argv[])\n {\n struct sockaddr_in addr = { .sin_family = AF_INET, .sin_addr.s_addr = htonl(INADDR_LOOPBACK) };\n struct iovec iov = { };\n struct msghdr hdr = { .msg_name = \u0026addr, .msg_namelen = sizeof(addr), .msg_iov = \u0026iov, .msg_iovlen = 1 };\n sendmsg(socket(PF_IEEE802154, SOCK_RAW, 0), \u0026hdr, 0);\n return 0;\n }\n ----------\n\nNote that this might be a sign that commit fd1894224407c484 (\"bpf: Don\u0027t\nredirect packets with invalid pkt_len\") should be reverted, for\nskb-\u003elen == 0 was acceptable for at least PF_IEEE802154 socket."
}
],
"providerMetadata": {
"dateUpdated": "2025-12-24T10:55:20.835Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4a36de8947794fa21435d1e916e089095f3246a8"
},
{
"url": "https://git.kernel.org/stable/c/791489a5c56396ddfed75fc525066d4738dace46"
},
{
"url": "https://git.kernel.org/stable/c/34f31a2b667914ab701ca725554a0b447809d7ef"
},
{
"url": "https://git.kernel.org/stable/c/df0da3fc131132b6c32a15c4da4ffa3a5aea1af2"
},
{
"url": "https://git.kernel.org/stable/c/9974d220c5073d035b5469d1d8ecd71da86c7afd"
},
{
"url": "https://git.kernel.org/stable/c/b12e924a2f5b960373459c8f8a514f887adf5cac"
}
],
"title": "net/ieee802154: don\u0027t warn zero-sized raw_sendmsg()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2022-50706",
"datePublished": "2025-12-24T10:55:20.835Z",
"dateReserved": "2025-12-24T10:53:15.518Z",
"dateUpdated": "2025-12-24T10:55:20.835Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2022-50706\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-24T11:15:50.780\",\"lastModified\":\"2025-12-29T15:58:56.260\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/ieee802154: don\u0027t warn zero-sized raw_sendmsg()\\n\\nsyzbot is hitting skb_assert_len() warning at __dev_queue_xmit() [1],\\nfor PF_IEEE802154 socket\u0027s zero-sized raw_sendmsg() request is hitting\\n__dev_queue_xmit() with skb-\u003elen == 0.\\n\\nSince PF_IEEE802154 socket\u0027s zero-sized raw_sendmsg() request was\\nable to return 0, don\u0027t call __dev_queue_xmit() if packet length is 0.\\n\\n ----------\\n #include \u003csys/socket.h\u003e\\n #include \u003cnetinet/in.h\u003e\\n\\n int main(int argc, char *argv[])\\n {\\n struct sockaddr_in addr = { .sin_family = AF_INET, .sin_addr.s_addr = htonl(INADDR_LOOPBACK) };\\n struct iovec iov = { };\\n struct msghdr hdr = { .msg_name = \u0026addr, .msg_namelen = sizeof(addr), .msg_iov = \u0026iov, .msg_iovlen = 1 };\\n sendmsg(socket(PF_IEEE802154, SOCK_RAW, 0), \u0026hdr, 0);\\n return 0;\\n }\\n ----------\\n\\nNote that this might be a sign that commit fd1894224407c484 (\\\"bpf: Don\u0027t\\nredirect packets with invalid pkt_len\\\") should be reverted, for\\nskb-\u003elen == 0 was acceptable for at least PF_IEEE802154 socket.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/34f31a2b667914ab701ca725554a0b447809d7ef\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4a36de8947794fa21435d1e916e089095f3246a8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/791489a5c56396ddfed75fc525066d4738dace46\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9974d220c5073d035b5469d1d8ecd71da86c7afd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b12e924a2f5b960373459c8f8a514f887adf5cac\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/df0da3fc131132b6c32a15c4da4ffa3a5aea1af2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…