Vulnerability-Lookup

FKIE_CVE-2022-49340

Vulnerability from fkie_nvd - Published: 2025-02-26 07:01 - Updated: 2026-08-04 10:17

Severity

7.1 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: ip_gre: test csum_start instead of transport header GRE with TUNNEL_CSUM will apply local checksum offload on CHECKSUM_PARTIAL packets. ipgre_xmit must validate csum_start after an optional skb_pull, else lco_csum may trigger an overflow. The original check was if (csum && skb_checksum_start(skb) < skb->data) return -EINVAL; This had false positives when skb_checksum_start is undefined: when ip_summed is not CHECKSUM_PARTIAL. A discussed refinement was straightforward if (csum && skb->ip_summed == CHECKSUM_PARTIAL && skb_checksum_start(skb) < skb->data) return -EINVAL; But was eventually revised more thoroughly: - restrict the check to the only branch where needed, in an uncommon GRE path that uses header_ops and calls skb_pull. - test skb_transport_header, which is set along with csum_start in skb_partial_csum_set in the normal header_ops datapath. Turns out skbs can arrive in this branch without the transport header set, e.g., through BPF redirection. Revise the check back to check csum_start directly, and only if CHECKSUM_PARTIAL. Do leave the check in the updated location. Check field regardless of whether TUNNEL_CSUM is configured.

References

URL	Tags
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/0c92d813c7c9ca2212ecd879232e7d87362fce98	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/0ffa268724656633af5f37a38c212326d98ebe8c	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/3d08bc3a5d9b2106f5c8bcf1adb73147824aa006	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/7596bd7920985f7fc8579a92e48bc53ce4475b21	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/8d21e9963bec1aad2280cdd034c8993033ef2948	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/e6b6f98fc7605c06c0a3baa70f62c534d7b4ce58	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/fbeb8dfa8b87ef259eef0c89e39b53962a3cf604	Patch

Impacted products

Vendor	Product	Version
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	5.19

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/ip_gre.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7596bd7920985f7fc8579a92e48bc53ce4475b21",
              "status": "affected",
              "version": "774430026bd9a472d08c5d3c33351a782315771a",
              "versionType": "git"
            },
            {
              "lessThan": "3d08bc3a5d9b2106f5c8bcf1adb73147824aa006",
              "status": "affected",
              "version": "3d32ce5472bb2ca720bef84089b85f76a705fd1a",
              "versionType": "git"
            },
            {
              "lessThan": "fbeb8dfa8b87ef259eef0c89e39b53962a3cf604",
              "status": "affected",
              "version": "87b34cd6485192777f632f92d592f2a71d8801a6",
              "versionType": "git"
            },
            {
              "lessThan": "e6b6f98fc7605c06c0a3baa70f62c534d7b4ce58",
              "status": "affected",
              "version": "8a0ed250f911da31a2aef52101bc707846a800ff",
              "versionType": "git"
            },
            {
              "lessThan": "0c92d813c7c9ca2212ecd879232e7d87362fce98",
              "status": "affected",
              "version": "8a0ed250f911da31a2aef52101bc707846a800ff",
              "versionType": "git"
            },
            {
              "lessThan": "0ffa268724656633af5f37a38c212326d98ebe8c",
              "status": "affected",
              "version": "8a0ed250f911da31a2aef52101bc707846a800ff",
              "versionType": "git"
            },
            {
              "lessThan": "8d21e9963bec1aad2280cdd034c8993033ef2948",
              "status": "affected",
              "version": "8a0ed250f911da31a2aef52101bc707846a800ff",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4bf5d5224ffca069df4501ba5fcc6ded9c002ead",
              "versionType": "git"
            },
            {
              "lessThan": "4.19.247",
              "status": "affected",
              "version": "4.19.207",
              "versionType": "semver"
            },
            {
              "lessThan": "5.4.198",
              "status": "affected",
              "version": "5.4.148",
              "versionType": "semver"
            },
            {
              "lessThan": "5.10.122",
              "status": "affected",
              "version": "5.10.68",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15",
              "status": "affected",
              "version": "5.14.7",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/ip_gre.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.247",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.198",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.122",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.47",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.15",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D758AE59-1429-4455-9E8F-244E41414654",
              "versionEndExcluding": "4.19.247",
              "versionStartIncluding": "4.19.207",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "778C5851-261F-4070-AE38-F056B612B584",
              "versionEndExcluding": "5.4.198",
              "versionStartIncluding": "5.4.148",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "3D30A79A-020A-4BA5-BA90-E965C6B06CBC",
              "versionEndExcluding": "5.10.122",
              "versionStartIncluding": "5.10.68",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "31C62BC3-6423-42BD-BD63-22A637FAA2A9",
              "versionEndExcluding": "5.15.47",
              "versionStartIncluding": "5.14.7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "53E7AA2E-2FB4-45CA-A22B-08B4EDBB51AD",
              "versionEndExcluding": "5.17.15",
              "versionStartIncluding": "5.16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "FA6D643C-6D6A-4821-8A8D-B5776B8F0103",
              "versionEndExcluding": "5.18.4",
              "versionStartIncluding": "5.18",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:5.19:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "A8C30C2D-F82D-4D37-AB48-D76ABFBD5377",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nip_gre: test csum_start instead of transport header\n\nGRE with TUNNEL_CSUM will apply local checksum offload on\nCHECKSUM_PARTIAL packets.\n\nipgre_xmit must validate csum_start after an optional skb_pull,\nelse lco_csum may trigger an overflow. The original check was\n\n\tif (csum \u0026\u0026 skb_checksum_start(skb) \u003c skb-\u003edata)\n\t\treturn -EINVAL;\n\nThis had false positives when skb_checksum_start is undefined:\nwhen ip_summed is not CHECKSUM_PARTIAL. A discussed refinement\nwas straightforward\n\n\tif (csum \u0026\u0026 skb-\u003eip_summed == CHECKSUM_PARTIAL \u0026\u0026\n\t    skb_checksum_start(skb) \u003c skb-\u003edata)\n\t\treturn -EINVAL;\n\nBut was eventually revised more thoroughly:\n- restrict the check to the only branch where needed, in an\n  uncommon GRE path that uses header_ops and calls skb_pull.\n- test skb_transport_header, which is set along with csum_start\n  in skb_partial_csum_set in the normal header_ops datapath.\n\nTurns out skbs can arrive in this branch without the transport\nheader set, e.g., through BPF redirection.\n\nRevise the check back to check csum_start directly, and only if\nCHECKSUM_PARTIAL. Do leave the check in the updated location.\nCheck field regardless of whether TUNNEL_CSUM is configured."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ip_gre: prueba csum_start en lugar del encabezado de transporte GRE con TUNNEL_CSUM aplicar\u00e1 la descarga de suma de comprobaci\u00f3n local en los paquetes CHECKSUM_PARTIAL. ipgre_xmit debe validar csum_start despu\u00e9s de un skb_pull opcional, de lo contrario lco_csum puede provocar un desbordamiento. La comprobaci\u00f3n original era if (csum \u0026amp;\u0026amp; skb_checksum_start(skb) \u0026lt; skb-\u0026gt;data) return -EINVAL; Esto ten\u00eda falsos positivos cuando skb_checksum_start no est\u00e1 definido: cuando ip_summed no es CHECKSUM_PARTIAL. Una mejora discutida fue sencilla if (csum \u0026amp;\u0026amp; skb-\u0026gt;ip_summed == CHECKSUM_PARTIAL \u0026amp;\u0026amp; skb_checksum_start(skb) \u0026lt; skb-\u0026gt;data) return -EINVAL; Pero finalmente se revis\u00f3 m\u00e1s a fondo: - restringir la verificaci\u00f3n a la \u00fanica rama donde sea necesario, en una ruta GRE poco com\u00fan que usa header_ops y llama a skb_pull. - probar skb_transport_header, que se establece junto con csum_start en skb_partial_csum_set en la ruta de datos header_ops normal. Resulta que skbs puede llegar a esta rama sin el encabezado de transporte establecido, por ejemplo, a trav\u00e9s de la redirecci\u00f3n BPF. Revise la verificaci\u00f3n nuevamente para verificar csum_start directamente, y solo si CHECKSUM_PARTIAL. Deje la verificaci\u00f3n en la ubicaci\u00f3n actualizada. Verifique el campo independientemente de si TUNNEL_CSUM est\u00e1 configurado."
    }
  ],
  "id": "CVE-2022-49340",
  "lastModified": "2026-08-04T10:17:45.080",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.2,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2025-02-26T07:01:10.753",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/0c92d813c7c9ca2212ecd879232e7d87362fce98"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/0ffa268724656633af5f37a38c212326d98ebe8c"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/3d08bc3a5d9b2106f5c8bcf1adb73147824aa006"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/7596bd7920985f7fc8579a92e48bc53ce4475b21"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/8d21e9963bec1aad2280cdd034c8993033ef2948"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/e6b6f98fc7605c06c0a3baa70f62c534d7b4ce58"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/fbeb8dfa8b87ef259eef0c89e39b53962a3cf604"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2022-49340 (GCVE-0-2022-49340)

Vulnerability from cvelistv5 – Published: 2025-02-26 02:10 – Updated: 2026-08-05 08:54

Title

ip_gre: test csum_start instead of transport header

Summary

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Assigner

Linux mitre root

References

7 references

URL	Tags
https://git.kernel.org/stable/c/7596bd7920985f7fc…
https://git.kernel.org/stable/c/3d08bc3a5d9b2106f…
https://git.kernel.org/stable/c/fbeb8dfa8b87ef259…
https://git.kernel.org/stable/c/e6b6f98fc7605c06c…
https://git.kernel.org/stable/c/0c92d813c7c9ca221…
https://git.kernel.org/stable/c/0ffa268724656633a…
https://git.kernel.org/stable/c/8d21e9963bec1aad2…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 774430026bd9a472d08c5d3c33351a782315771a , < 7596bd7920985f7fc8579a92e48bc53ce4475b21 (git) Affected: 3d32ce5472bb2ca720bef84089b85f76a705fd1a , < 3d08bc3a5d9b2106f5c8bcf1adb73147824aa006 (git) Affected: 87b34cd6485192777f632f92d592f2a71d8801a6 , < fbeb8dfa8b87ef259eef0c89e39b53962a3cf604 (git) Affected: 8a0ed250f911da31a2aef52101bc707846a800ff , < e6b6f98fc7605c06c0a3baa70f62c534d7b4ce58 (git) Affected: 8a0ed250f911da31a2aef52101bc707846a800ff , < 0c92d813c7c9ca2212ecd879232e7d87362fce98 (git) Affected: 8a0ed250f911da31a2aef52101bc707846a800ff , < 0ffa268724656633af5f37a38c212326d98ebe8c (git) Affected: 8a0ed250f911da31a2aef52101bc707846a800ff , < 8d21e9963bec1aad2280cdd034c8993033ef2948 (git) Affected: 4bf5d5224ffca069df4501ba5fcc6ded9c002ead (git) Affected: 4.19.207 , < 4.19.247 (semver) Affected: 5.4.148 , < 5.4.198 (semver) Affected: 5.10.68 , < 5.10.122 (semver) Affected: 5.14.7 , < 5.15 (semver)
Linux	Linux	Affected: 5.15 Unaffected: 0 , < 5.15 (semver) Unaffected: 4.19.247 , ≤ 4.19.* (semver) Unaffected: 5.4.198 , ≤ 5.4.* (semver) Unaffected: 5.10.122 , ≤ 5.10.* (semver) Unaffected: 5.15.47 , ≤ 5.15.* (semver) Unaffected: 5.17.15 , ≤ 5.17.* (semver) Unaffected: 5.18.4 , ≤ 5.18.* (semver) Unaffected: 5.19 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/ip_gre.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7596bd7920985f7fc8579a92e48bc53ce4475b21",
              "status": "affected",
              "version": "774430026bd9a472d08c5d3c33351a782315771a",
              "versionType": "git"
            },
            {
              "lessThan": "3d08bc3a5d9b2106f5c8bcf1adb73147824aa006",
              "status": "affected",
              "version": "3d32ce5472bb2ca720bef84089b85f76a705fd1a",
              "versionType": "git"
            },
            {
              "lessThan": "fbeb8dfa8b87ef259eef0c89e39b53962a3cf604",
              "status": "affected",
              "version": "87b34cd6485192777f632f92d592f2a71d8801a6",
              "versionType": "git"
            },
            {
              "lessThan": "e6b6f98fc7605c06c0a3baa70f62c534d7b4ce58",
              "status": "affected",
              "version": "8a0ed250f911da31a2aef52101bc707846a800ff",
              "versionType": "git"
            },
            {
              "lessThan": "0c92d813c7c9ca2212ecd879232e7d87362fce98",
              "status": "affected",
              "version": "8a0ed250f911da31a2aef52101bc707846a800ff",
              "versionType": "git"
            },
            {
              "lessThan": "0ffa268724656633af5f37a38c212326d98ebe8c",
              "status": "affected",
              "version": "8a0ed250f911da31a2aef52101bc707846a800ff",
              "versionType": "git"
            },
            {
              "lessThan": "8d21e9963bec1aad2280cdd034c8993033ef2948",
              "status": "affected",
              "version": "8a0ed250f911da31a2aef52101bc707846a800ff",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4bf5d5224ffca069df4501ba5fcc6ded9c002ead",
              "versionType": "git"
            },
            {
              "lessThan": "4.19.247",
              "status": "affected",
              "version": "4.19.207",
              "versionType": "semver"
            },
            {
              "lessThan": "5.4.198",
              "status": "affected",
              "version": "5.4.148",
              "versionType": "semver"
            },
            {
              "lessThan": "5.10.122",
              "status": "affected",
              "version": "5.10.68",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15",
              "status": "affected",
              "version": "5.14.7",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/ip_gre.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.247",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.198",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.122",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.47",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.15",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.247",
                  "versionStartIncluding": "4.19.207",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.198",
                  "versionStartIncluding": "5.4.148",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.122",
                  "versionStartIncluding": "5.10.68",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.47",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.15",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.4",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.14.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nip_gre: test csum_start instead of transport header\n\nGRE with TUNNEL_CSUM will apply local checksum offload on\nCHECKSUM_PARTIAL packets.\n\nipgre_xmit must validate csum_start after an optional skb_pull,\nelse lco_csum may trigger an overflow. The original check was\n\n\tif (csum \u0026\u0026 skb_checksum_start(skb) \u003c skb-\u003edata)\n\t\treturn -EINVAL;\n\nThis had false positives when skb_checksum_start is undefined:\nwhen ip_summed is not CHECKSUM_PARTIAL. A discussed refinement\nwas straightforward\n\n\tif (csum \u0026\u0026 skb-\u003eip_summed == CHECKSUM_PARTIAL \u0026\u0026\n\t    skb_checksum_start(skb) \u003c skb-\u003edata)\n\t\treturn -EINVAL;\n\nBut was eventually revised more thoroughly:\n- restrict the check to the only branch where needed, in an\n  uncommon GRE path that uses header_ops and calls skb_pull.\n- test skb_transport_header, which is set along with csum_start\n  in skb_partial_csum_set in the normal header_ops datapath.\n\nTurns out skbs can arrive in this branch without the transport\nheader set, e.g., through BPF redirection.\n\nRevise the check back to check csum_start directly, and only if\nCHECKSUM_PARTIAL. Do leave the check in the updated location.\nCheck field regardless of whether TUNNEL_CSUM is configured."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The defect is in ipgre_xmit\u2019s header_ops TX path (local send via the GRE netdev, AF_PACKET/splice, or BPF redirect into that device), not in GRE receive or any remote packet parser.\nAC:L - An attacker who can create/use an NBMA/header_ops GRE device with TUNNEL_CSUM and submit a CHECKSUM_PARTIAL skb whose csum_start falls in the pulled region can trigger the bad lco_csum length deterministically; syzbot reproduced the class of crash without races.\nPR:L - Creating or configuring the GRE tunnel and driving the path needs CAP_NET_ADMIN (and often CAP_NET_RAW for packet sockets), both obtainable in a user namespace, so only unprivileged userns access is required\u2014not real init-ns root.\nUI:N - The attacker opens the netns, sets up the tunnel, and sends the crafted skb themselves; no separate victim action is required.\nS:U - Impact stays inside the same host kernel authority (OOB read/oops on that machine\u2019s networking stack); it is not a VM escape, IOMMU bypass, or other cross-boundary break.\nC:H - When csum_start sits before the post-pull/GRE transport header, csum_start-l4_hdr becomes a huge unsigned length into do_csum/csum_partial, yielding an unbounded out-of-bounds read of kernel memory (not a few fixed bytes), scored Confidentiality High per OOB-read guidance.\nI:N - The failure is a pure over-read while building the GRE checksum; there is no OOB write, UAF, or other corruption that yields an arbitrary-write or control-flow hijack primitive.\nA:H - The same huge-length csum_partial walk hits unmapped pages and produces a kernel paging-fault oops/panic (as in the syzbot report), fully denying availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:54:49.092Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7596bd7920985f7fc8579a92e48bc53ce4475b21"
        },
        {
          "url": "https://git.kernel.org/stable/c/3d08bc3a5d9b2106f5c8bcf1adb73147824aa006"
        },
        {
          "url": "https://git.kernel.org/stable/c/fbeb8dfa8b87ef259eef0c89e39b53962a3cf604"
        },
        {
          "url": "https://git.kernel.org/stable/c/e6b6f98fc7605c06c0a3baa70f62c534d7b4ce58"
        },
        {
          "url": "https://git.kernel.org/stable/c/0c92d813c7c9ca2212ecd879232e7d87362fce98"
        },
        {
          "url": "https://git.kernel.org/stable/c/0ffa268724656633af5f37a38c212326d98ebe8c"
        },
        {
          "url": "https://git.kernel.org/stable/c/8d21e9963bec1aad2280cdd034c8993033ef2948"
        }
      ],
      "title": "ip_gre: test csum_start instead of transport header",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49340",
    "datePublished": "2025-02-26T02:10:57.322Z",
    "dateReserved": "2025-02-26T02:08:31.541Z",
    "dateUpdated": "2026-08-05T08:54:49.092Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

FKIE_CVE-2022-49340

CVE-2022-49340 (GCVE-0-2022-49340)

Tags

Sightings

Nomenclature

Related by attack behaviour