CVE-2022-49340

In the Linux kernel, the following vulnerability has been resolved:

ip_gre: test csum_start instead of transport header

GRE with TUNNEL_CSUM will apply local checksum offload on CHECKSUM_PARTIAL packets.

ipgre_xmit must validate csum_start after an optional skb_pull, else lco_csum may trigger an overflow. The original check was

if (csum && skb_checksum_start(skb) < skb->data)
	return -EINVAL;

This had false positives when skb_checksum_start is undefined: when ip_summed is not CHECKSUM_PARTIAL. A discussed refinement was straightforward

if (csum && skb->ip_summed == CHECKSUM_PARTIAL &&
    skb_checksum_start(skb) < skb->data)
	return -EINVAL;

But was eventually revised more thoroughly:

• restrict the check to the only branch where needed, in an uncommon GRE path that uses header_ops and calls skb_pull.
• test skb_transport_header, which is set along with csum_start in skb_partial_csum_set in the normal header_ops datapath.

Turns out skbs can arrive in this branch without the transport header set, e.g., through BPF redirection.

Revise the check back to check csum_start directly, and only if CHECKSUM_PARTIAL. Do leave the check in the updated location. Check field regardless of whether TUNNEL_CSUM is configured.

This vulnerability is rated as Low severity because exploiting it requires local privileges or specific BPF redirection configurations on systems utilizing IPv4 GRE network tunneling, limiting the blast radius to a denial of service without compromising data integrity or confidentiality. Generic Routing Encapsulation (GRE) interfaces are not configured by default on standard Red Hat Enterprise Linux deployments. An attacker would require existing access to transmit specially crafted network packets through an active GRE tunnel datapath to trigger a kernel crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.