Bug 2115278 (CVE-2022-36946) - CVE-2022-36946 kernel: DoS in nfqnl_mangle in net/netfilter/nfnetlink_queue.c
Summary: CVE-2022-36946 kernel: DoS in nfqnl_mangle in net/netfilter/nfnetlink_queue.c
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2022-36946
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2116157 2116159 2116160 2116161 2116162
Blocks: 2111859
TreeView+ depends on / blocked
 
Reported: 2022-08-04 10:47 UTC by Alex
Modified: 2024-02-08 16:51 UTC (History)
51 users (show)

Fixed In Version: Kernel 5.18.16
Doc Type: If docs needed, set a value
Doc Text:
A memory corruption flaw was found in the Linux kernel’s Netfilter subsystem in the way a local user uses the libnetfilter_queue when analyzing a corrupted network packet. This flaw allows a local user to crash the system or a remote user to crash the system when the libnetfilter_queue is used by a local user.
Clone Of:
Environment:
Last Closed: 2022-12-05 20:21:20 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2022:7444 0 None None None 2022-11-08 09:10:33 UTC
Red Hat Product Errata RHSA-2022:7683 0 None None None 2022-11-08 10:10:22 UTC
Red Hat Product Errata RHSA-2022:7933 0 None None None 2022-11-15 09:45:46 UTC
Red Hat Product Errata RHSA-2022:8267 0 None None None 2022-11-15 10:48:58 UTC
Red Hat Product Errata RHSA-2024:0724 0 None None None 2024-02-07 16:29:15 UTC

Description Alex 2022-08-04 10:47:08 UTC 
A Linux Kernel flaw found in the net/netfilter/nfnetlink_queue.c.
If local user creates netfilter rule that truncates the packet below the header size, the skb_pull() will result in a malformed skb (skb->len < 0).
As result, denial of service could happen after incorrect check in nfqnl_mangle function.

Fixes: 7af4cc3fa158 ("[NETFILTER]: Add "nfnetlink_queue" netfilter queue handler over nfnetlink")

Reference:
https://lore.kernel.org/all/20220726104206.2036-1-fw@strlen.de/t/
Comment 1 Alex 2022-08-07 16:02:16 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2116157]
Comment 4 Justin M. Forbes 2022-08-11 12:59:32 UTC 
This was fixed for Fedora with the 5.18.16 stable kernel update.
Comment 5 errata-xmlrpc 2022-11-08 09:10:29 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:7444 https://access.redhat.com/errata/RHSA-2022:7444
Comment 6 errata-xmlrpc 2022-11-08 10:10:17 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:7683 https://access.redhat.com/errata/RHSA-2022:7683
Comment 7 errata-xmlrpc 2022-11-15 09:45:42 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2022:7933 https://access.redhat.com/errata/RHSA-2022:7933
Comment 8 errata-xmlrpc 2022-11-15 10:48:54 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2022:8267 https://access.redhat.com/errata/RHSA-2022:8267
Comment 9 Product Security DevOps Team 2022-12-05 20:21:15 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-36946
Comment 13 errata-xmlrpc 2024-02-07 16:29:11 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2024:0724 https://access.redhat.com/errata/RHSA-2024:0724
Note You need to log in before you can comment on or make changes to this bug.