CVE-2022-50405

一、漏洞信息
 漏洞编号：[CVE-2022-50405](https://nvd.nist.gov/vuln/detail/CVE-2022-50405)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：N/A None
  Vector：CVSS：3.0/
 漏洞简述：
  In the Linux kernel, there is a race condition vulnerability in VXLAN that when deleting a VXLAN device during packet reception, there is a possibility that the sock is released after getting vxlan_sock vs from sk_user_data. This results in NULL pointer dereference in later vxlan_ecn_decapsulate() and vxlan_get_sk_family() functions, causing system crash. The vulnerability affects Linux Kernel versions from 3.18 to 6.1.1.
 漏洞公开时间：2025-09-19 00:15:43
 漏洞创建时间：2025-09-19 01:33:50
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2022-50405
<details>
<summary>更多参考(点击展开)</summary>

无
</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  七彩瞬析开源风险感知平台
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| gregkh/linux |  | https://git.kernel.org/stable/c/84e566d157cc22ad2da8bdd970495855fbf13d92 |  | ljqc |
| gregkh/linux |  | https://git.kernel.org/stable/c/303000c793f705d07b551eb7c1c27001c5b33c8d |  | ljqc |
| gregkh/linux |  | https://git.kernel.org/stable/c/91f09a776ae335ca836ed864b8f2a9461882a280 |  | ljqc |
| gregkh/linux |  | https://git.kernel.org/stable/c/9a6544343bba7da929d6d4a2dc44ec0f15970081 |  | ljqc |
| gregkh/linux |  | https://git.kernel.org/stable/c/b38aa7465411795e9e744b8d94633910497fec2a |  | ljqc |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
      In the Linux kernel, the following vulnerability has been resolved:net/tunnel: wait until all sk_user_data reader finish before releasing the sockThere is a race condition in vxlan that when deleting a vxlan deviceduring receiving packets, there is a possibility that the sock isreleased after getting vxlan_sock vs from sk_user_data. Then inlater vxlan_ecn_decapsulate(), vxlan_get_sk_family() we will gotNULL pointer dereference. e.g.   #0 [ffffa25ec6978a38] machine_kexec at ffffffff8c669757   #1 [ffffa25ec6978a90] __crash_kexec at ffffffff8c7c0a4d   #2 [ffffa25ec6978b58] crash_kexec at ffffffff8c7c1c48   #3 [ffffa25ec6978b60] oops_end at ffffffff8c627f2b   #4 [ffffa25ec6978b80] page_fault_oops at ffffffff8c678fcb   #5 [ffffa25ec6978bd8] exc_page_fault at ffffffff8d109542   #6 [ffffa25ec6978c00] asm_exc_page_fault at ffffffff8d200b62      [exception RIP: vxlan_ecn_decapsulate+0x3b]      RIP: ffffffffc1014e7b  RSP: ffffa25ec6978cb0  RFLAGS: 00010246      RAX: 0000000000000008  RBX: ffff8aa000888000  RCX: 0000000000000000      RDX: 000000000000000e  RSI: ffff8a9fc7ab803e  RDI: ffff8a9fd1168700      RBP: ffff8a9fc7ab803e   R8: 0000000000700000   R9: 00000000000010ae      R10: ffff8a9fcb748980  R11: 0000000000000000  R12: ffff8a9fd1168700      R13: ffff8aa000888000  R14: 00000000002a0000  R15: 00000000000010ae      ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018   #7 [ffffa25ec6978ce8] vxlan_rcv at ffffffffc10189cd [vxlan]   #8 [ffffa25ec6978d90] udp_queue_rcv_one_skb at ffffffff8cfb6507   #9 [ffffa25ec6978dc0] udp_unicast_rcv_skb at ffffffff8cfb6e45  #10 [ffffa25ec6978dc8] __udp4_lib_rcv at ffffffff8cfb8807  #11 [ffffa25ec6978e20] ip_protocol_deliver_rcu at ffffffff8cf76951  #12 [ffffa25ec6978e48] ip_local_deliver at ffffffff8cf76bde  #13 [ffffa25ec6978ea0] __netif_receive_skb_one_core at ffffffff8cecde9b  #14 [ffffa25ec6978ec8] process_backlog at ffffffff8cece139  #15 [ffffa25ec6978f00] __napi_poll at ffffffff8ceced1a  #16 [ffffa25ec6978f28] net_rx_action at ffffffff8cecf1f3  #17 [ffffa25ec6978fa0] __softirqentry_text_start at ffffffff8d4000ca  #18 [ffffa25ec6978ff0] do_softirq at ffffffff8c6fbdc3Reproducer: <a href= https://github.com/Mellanox/ovs-tests/blob/master/test-ovs-vxlan-remove-tunnel-during-traffic.sh  rel= nofollow >https://github.com/Mellanox/ovs-tests/blob/master/test-ovs-vxlan-remove-tunnel-during-traffic.sh</a>Fix this by waiting for all sk_user_data reader to finish beforereleasing the sock.The Linux kernel CVE team has assigned CVE-2022-50405 to this issue.  
 openEuler评分：
  7.0
 Vector：CVSS：3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(4.19.90):受影响
2.master(6.12.33):不受影响
3.openEuler-22.03-LTS-SP3(5.10.0):不受影响
4.openEuler-22.03-LTS-SP4(5.10.0):不受影响
5.openEuler-24.03-LTS:不受影响
6.openEuler-24.03-LTS-Next:不受影响
7.openEuler-24.03-LTS-SP1:不受影响
8.openEuler-24.03-LTS-SP2:不受影响

修复是否涉及abi变化(是/否)：
  1.master(6.12.33):否
2.openEuler-20.03-LTS-SP4(4.19.90):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.openEuler-22.03-LTS-SP4(5.10.0):否
5.openEuler-24.03-LTS:否
6.openEuler-24.03-LTS-Next:否
7.openEuler-24.03-LTS-SP1:否
8.openEuler-24.03-LTS-SP2:否

原因说明：
  1.openEuler-20.03-LTS-SP4(4.19.90):正常修复
2.master(6.12.33):不受影响-漏洞代码不能被攻击者触发
3.openEuler-22.03-LTS-SP3(5.10.0):不受影响-漏洞代码不能被攻击者触发
4.openEuler-22.03-LTS-SP4(5.10.0):不受影响-漏洞代码不能被攻击者触发
5.openEuler-24.03-LTS:不受影响-漏洞代码不能被攻击者触发
6.openEuler-24.03-LTS-Next:不受影响-漏洞代码不能被攻击者触发
7.openEuler-24.03-LTS-SP1:不受影响-漏洞代码不能被攻击者触发
8.openEuler-24.03-LTS-SP2:不受影响-漏洞代码不能被攻击者触发

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2025-2553

src-openEuler/kernel

Content Risk Flag

Comments (5)

src-openEuler/kernel .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2022-50405

Comments (5)

Search

src-openEuler/kernel