CVE-2022-50063

一、漏洞信息
 漏洞编号：[CVE-2022-50063](https://nvd.nist.gov/vuln/detail/CVE-2022-50063)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：N/A None
  Vector：CVSS：3.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:net: dsa: felix: suppress non-changes to the tagging protocolThe way in which dsa_tree_change_tag_proto() works is that whendsa_tree_notify() fails, it doesn t know whether the operation failedmid way in a multi-switch tree, or it failed for a single-switch tree.So even though drivers need to fail cleanly inds->ops->change_tag_protocol(), DSA will still call dsa_tree_notify()again, to restore the old tag protocol for potential switches in thetree where the change did succeeed (before failing for others).This means for the felix driver that if we report an error infelix_change_tag_protocol(), we ll get another call where proto_ops ==old_proto_ops. If we proceed to act upon that, we may do unexpectedthings. For example, we will call dsa_tag_8021q_register() twice in arow, without any dsa_tag_8021q_unregister() in between. Then we willactually call dsa_tag_8021q_unregister() via old_proto_ops->teardown,which (if it manages to run at all, after walking through corrupted datastructures) will leave the ports inoperational anyway.The bug can be readily reproduced if we force an error while intag_8021q mode; this crashes the kernel.echo ocelot-8021q > /sys/class/net/eno2/dsa/taggingecho edsa > /sys/class/net/eno2/dsa/tagging # -EPROTONOSUPPORTUnable to handle kernel NULL pointer dereference at virtual address 0000000000000014Call trace: vcap_entry_get+0x24/0x124 ocelot_vcap_filter_del+0x198/0x270 felix_tag_8021q_vlan_del+0xd4/0x21c dsa_switch_tag_8021q_vlan_del+0x168/0x2cc dsa_switch_event+0x68/0x1170 dsa_tree_notify+0x14/0x34 dsa_port_tag_8021q_vlan_del+0x84/0x110 dsa_tag_8021q_unregister+0x15c/0x1c0 felix_tag_8021q_teardown+0x16c/0x180 felix_change_tag_protocol+0x1bc/0x230 dsa_switch_event+0x14c/0x1170 dsa_tree_change_tag_proto+0x118/0x1c0
 漏洞公开时间：2025-06-18 19:15:35
 漏洞创建时间：2025-06-19 11:19:20
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2022-50063
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
|  | https://git.kernel.org/stable/c/4c46bb49460ee14c69629e813640d8b929e88941 |  |
|  | https://git.kernel.org/stable/c/8e432f157c3edc5a97a7244c666589a438f5e4d4 |  |
|  | https://lore.kernel.org/linux-cve-announce/2025061850-CVE-2022-50063-a233@gregkh/T/#u |  |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  七彩瞬析开源风险感知平台
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://git.kernel.org/stable/c/4c46bb49460ee14c69629e813640d8b929e88941 |  | nvd |
|  |  | https://git.kernel.org/stable/c/8e432f157c3edc5a97a7244c666589a438f5e4d4 |  | nvd |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:net: dsa: felix: suppress non-changes to the tagging protocolThe way in which dsa_tree_change_tag_proto() works is that whendsa_tree_notify() fails, it doesn&#39;t know whether the operation failedmid way in a multi-switch tree, or it failed for a single-switch tree.So even though drivers need to fail cleanly inds-&gt;ops-&gt;change_tag_protocol(), DSA will still call dsa_tree_notify()again, to restore the old tag protocol for potential switches in thetree where the change did succeeed (before failing for others).This means for the felix driver that if we report an error infelix_change_tag_protocol(), we&#39;ll get another call where proto_ops ==old_proto_ops. If we proceed to act upon that, we may do unexpectedthings. For example, we will call dsa_tag_8021q_register() twice in arow, without any dsa_tag_8021q_unregister() in between. Then we willactually call dsa_tag_8021q_unregister() via old_proto_ops-&gt;teardown,which (if it manages to run at all, after walking through corrupted datastructures) will leave the ports inoperational anyway.The bug can be readily reproduced if we force an error while intag_8021q mode; this crashes the kernel.echo ocelot-8021q &gt; /sys/class/net/eno2/dsa/taggingecho edsa &gt; /sys/class/net/eno2/dsa/tagging # -EPROTONOSUPPORTUnable to handle kernel NULL pointer dereference at virtual address 0000000000000014Call trace: vcap_entry_get+0x24/0x124 ocelot_vcap_filter_del+0x198/0x270 felix_tag_8021q_vlan_del+0xd4/0x21c dsa_switch_tag_8021q_vlan_del+0x168/0x2cc dsa_switch_event+0x68/0x1170 dsa_tree_notify+0x14/0x34 dsa_port_tag_8021q_vlan_del+0x84/0x110 dsa_tag_8021q_unregister+0x15c/0x1c0 felix_tag_8021q_teardown+0x16c/0x180 felix_change_tag_protocol+0x1bc/0x230 dsa_switch_event+0x14c/0x1170 dsa_tree_change_tag_proto+0x118/0x1c0The Linux kernel CVE team has assigned CVE-2022-50063 to this issue.
 openEuler评分：
  3.9
 Vector：CVSS：3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
 受影响版本排查(受影响/不受影响)：
  1.master(6.12.33):不受影响
2.openEuler-20.03-LTS-SP4(4.19.90):不受影响
3.openEuler-22.03-LTS-SP3(5.10.0):不受影响
4.openEuler-22.03-LTS-SP4(5.10.0):不受影响
5.openEuler-24.03-LTS(6.6.0):不受影响
6.openEuler-24.03-LTS-Next(6.6.0):不受影响
7.openEuler-24.03-LTS-SP1(6.6.0):不受影响
8.openEuler-24.03-LTS-SP2(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.master(6.12.33):否
2.openEuler-20.03-LTS-SP4(4.19.90):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.openEuler-22.03-LTS-SP4(5.10.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-24.03-LTS-SP1(6.6.0):否
8.openEuler-24.03-LTS-SP2(6.6.0):否

原因说明：
  1.master(6.12.33):不受影响-漏洞代码不能被攻击者触发
2.openEuler-24.03-LTS(6.6.0):不受影响-漏洞代码不能被攻击者触发
3.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发
4.openEuler-24.03-LTS-SP1(6.6.0):不受影响-漏洞代码不能被攻击者触发
5.openEuler-24.03-LTS-SP2(6.6.0):不受影响-漏洞代码不能被攻击者触发
6.openEuler-20.03-LTS-SP4(4.19.90):不受影响-漏洞代码不存在
7.openEuler-22.03-LTS-SP3(5.10.0):不受影响-漏洞代码不存在
8.openEuler-22.03-LTS-SP4(5.10.0):不受影响-漏洞代码不存在

src-openEuler/kernel
Closed

Content Risk Flag

Comments (5)

src-openEuler/kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2022-50063

Comments (5)

Search

src-openEuler/kernel
Closed