CVE-2022-49672 (GCVE-0-2022-49672)
Vulnerability from cvelistv5
Published
2025-02-26 02:24
Modified
2025-05-04 08:43
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: tun: unlink NAPI from device on destruction
Syzbot found a race between tun file and device destruction.
NAPIs live in struct tun_file which can get destroyed before
the netdev so we have to del them explicitly. The current
code is missing deleting the NAPI if the queue was detached
first.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| ▼ | Linux | Linux |
Version: 943170998b200190f99d3fe7e771437e2c51f319 Version: 943170998b200190f99d3fe7e771437e2c51f319 Version: 943170998b200190f99d3fe7e771437e2c51f319 Version: 943170998b200190f99d3fe7e771437e2c51f319 Version: 943170998b200190f99d3fe7e771437e2c51f319 Version: 943170998b200190f99d3fe7e771437e2c51f319 |
||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/tun.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "82e729aee59acefe135fceffadcbc5b86dd4f1b9",
"status": "affected",
"version": "943170998b200190f99d3fe7e771437e2c51f319",
"versionType": "git"
},
{
"lessThan": "a8cf919022373c97a84fe596bbea544f909c485d",
"status": "affected",
"version": "943170998b200190f99d3fe7e771437e2c51f319",
"versionType": "git"
},
{
"lessThan": "bec1be0a745ab420718217e3e0d9542a75108989",
"status": "affected",
"version": "943170998b200190f99d3fe7e771437e2c51f319",
"versionType": "git"
},
{
"lessThan": "8145f77d38de4f88b8a69e1463f5c09ba189d77c",
"status": "affected",
"version": "943170998b200190f99d3fe7e771437e2c51f319",
"versionType": "git"
},
{
"lessThan": "8661d4b8faa2f7ee7a559969c0a7c57f077b1728",
"status": "affected",
"version": "943170998b200190f99d3fe7e771437e2c51f319",
"versionType": "git"
},
{
"lessThan": "3b9bc84d311104906d2b4995a9a02d7b7ddab2db",
"status": "affected",
"version": "943170998b200190f99d3fe7e771437e2c51f319",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/tun.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"lessThan": "4.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.251",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.204",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.129",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.18.*",
"status": "unaffected",
"version": "5.18.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "5.19",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.251",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.204",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.129",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.53",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.18.10",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.19",
"versionStartIncluding": "4.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: tun: unlink NAPI from device on destruction\n\nSyzbot found a race between tun file and device destruction.\nNAPIs live in struct tun_file which can get destroyed before\nthe netdev so we have to del them explicitly. The current\ncode is missing deleting the NAPI if the queue was detached\nfirst."
}
],
"providerMetadata": {
"dateUpdated": "2025-05-04T08:43:01.207Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/82e729aee59acefe135fceffadcbc5b86dd4f1b9"
},
{
"url": "https://git.kernel.org/stable/c/a8cf919022373c97a84fe596bbea544f909c485d"
},
{
"url": "https://git.kernel.org/stable/c/bec1be0a745ab420718217e3e0d9542a75108989"
},
{
"url": "https://git.kernel.org/stable/c/8145f77d38de4f88b8a69e1463f5c09ba189d77c"
},
{
"url": "https://git.kernel.org/stable/c/8661d4b8faa2f7ee7a559969c0a7c57f077b1728"
},
{
"url": "https://git.kernel.org/stable/c/3b9bc84d311104906d2b4995a9a02d7b7ddab2db"
}
],
"title": "net: tun: unlink NAPI from device on destruction",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2022-49672",
"datePublished": "2025-02-26T02:24:05.284Z",
"dateReserved": "2025-02-26T02:21:30.437Z",
"dateUpdated": "2025-05-04T08:43:01.207Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}