nvd-json-data-feeds/CVE-2022/CVE-2022-491xx/CVE-2022-49197.json

{
  "id": "CVE-2022-49197",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2025-02-26T07:00:56.770",
  "lastModified": "2025-02-26T07:00:56.770",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_netlink: Fix shift out of bounds in group mask calculation\n\nWhen a netlink message is received, netlink_recvmsg() fills in the address\nof the sender. One of the fields is the 32-bit bitfield nl_groups, which\ncarries the multicast group on which the message was received. The least\nsignificant bit corresponds to group 1, and therefore the highest group\nthat the field can represent is 32. Above that, the UB sanitizer flags the\nout-of-bounds shift attempts.\n\nWhich bits end up being set in such case is implementation defined, but\nit's either going to be a wrong non-zero value, or zero, which is at least\nnot misleading. Make the latter choice deterministic by always setting to 0\nfor higher-numbered multicast groups.\n\nTo get information about membership in groups >= 32, userspace is expected\nto use nl_pktinfo control messages[0], which are enabled by NETLINK_PKTINFO\nsocket option.\n[0] https://lwn.net/Articles/147608/\n\nThe way to trigger this issue is e.g. through monitoring the BRVLAN group:\n\n\t# bridge monitor vlan &\n\t# ip link add name br type bridge\n\nWhich produces the following citation:\n\n\tUBSAN: shift-out-of-bounds in net/netlink/af_netlink.c:162:19\n\tshift exponent 32 is too large for 32-bit type 'int'"
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: af_netlink: Se corrige el cambio fuera de los l\u00edmites en el c\u00e1lculo de la m\u00e1scara de grupo Cuando se recibe un mensaje netlink, netlink_recvmsg() completa la direcci\u00f3n del remitente. Uno de los campos es el campo de bits de 32 bits nl_groups, que lleva el grupo de multidifusi\u00f3n en el que se recibi\u00f3 el mensaje. El bit menos significativo corresponde al grupo 1 y, por lo tanto, el grupo m\u00e1s alto que el campo puede representar es 32. Por encima de eso, el depurador de UB marca los intentos de cambio fuera de los l\u00edmites. Los bits que terminan siendo establecidos en tal caso est\u00e1n definidos por la implementaci\u00f3n, pero ser\u00e1 un valor incorrecto distinto de cero o cero, lo que al menos no es enga\u00f1oso. Haga que la \u00faltima opci\u00f3n sea determinista estableciendo siempre en 0 para los grupos de multidifusi\u00f3n de n\u00famero superior. Para obtener informaci\u00f3n sobre la membres\u00eda en grupos >= 32, se espera que el espacio de usuario use los mensajes de control nl_pktinfo[0], que se habilitan mediante la opci\u00f3n de socket NETLINK_PKTINFO. [0] https://lwn.net/Articles/147608/ La forma de desencadenar este problema es, por ejemplo, a trav\u00e9s del monitoreo del grupo BRVLAN: # bridge monitor vlan & # ip link add name br type bridge Lo que produce la siguiente cita: UBSAN: shift-out-of-bounds in net/netlink/af_netlink.c:162:19 shift exponent 32 is too large for 32-bit type 'int'"
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/0caf6d9922192dd1afa8dc2131abfb4df1443b9f",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/41249fff507387c3323b198d0052faed08b14de4",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/7409ff6393a67ff9838d0ae1bd102fb5f020d07a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ac5883a8890a11c00b32a19949a25d4afeaa2f5a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b0898362188e05b2202656058cc32d98fabf3bac",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e1c5d46f05aa23d740daae5cd3a6472145afac42",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e23e1e981247feb3c7d0236fe58aceb685f234ae",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e8aaf3134bc5e943048eefe9f2ddaabf41d92b1a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f75f4abeec4c04b600a15b50c89a481f1e7435ee",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}