CVE-2022-49340

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ip_gre: test csum_start instead of transport header

GRE with TUNNEL_CSUM will apply local checksum offload on

CHECKSUM_PARTIAL packets.

ipgre_xmit must validate csum_start after an optional skb_pull,

else lco_csum may trigger an overflow. The original check was

if (csum && skb_checksum_start(skb) < skb->data)

return -EINVAL;

This had false positives when skb_checksum_start is undefined:

when ip_summed is not CHECKSUM_PARTIAL. A discussed refinement

was straightforward

if (csum && skb->ip_summed == CHECKSUM_PARTIAL &&

skb_checksum_start(skb) < skb->data)

return -EINVAL;

But was eventually revised more thoroughly:

- restrict the check to the only branch where needed, in an

uncommon GRE path that uses header_ops and calls skb_pull.

- test skb_transport_header, which is set along with csum_start

in skb_partial_csum_set in the normal header_ops datapath.

Turns out skbs can arrive in this branch withou

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References