Homepage

CVE-2022-49340 The advisory has been revoked - it doesn't affect any version of package rtla  (opens in a new tab)

Threat Intelligence

EPSS
0.28% (21st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL9-RTLA-9090540
  • published5 Mar 2025
  • disclosed26 Feb 2025
Report a new vulnerability Found a mistake?

Introduced: 26 Feb 2025

CVE-2022-49340  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:9.

NVD Description

Note: Versions mentioned in the description apply only to the upstream rtla package and not the rtla package as distributed by RHEL.

In the Linux kernel, the following vulnerability has been resolved:

ip_gre: test csum_start instead of transport header

GRE with TUNNEL_CSUM will apply local checksum offload on CHECKSUM_PARTIAL packets.

ipgre_xmit must validate csum_start after an optional skb_pull, else lco_csum may trigger an overflow. The original check was

if (csum && skb_checksum_start(skb) < skb->data)
    return -EINVAL;

This had false positives when skb_checksum_start is undefined: when ip_summed is not CHECKSUM_PARTIAL. A discussed refinement was straightforward

if (csum && skb->ip_summed == CHECKSUM_PARTIAL &&
    skb_checksum_start(skb) < skb->data)
    return -EINVAL;

But was eventually revised more thoroughly:

  • restrict the check to the only branch where needed, in an uncommon GRE path that uses header_ops and calls skb_pull.
  • test skb_transport_header, which is set along with csum_start in skb_partial_csum_set in the normal header_ops datapath.

Turns out skbs can arrive in this branch without the transport header set, e.g., through BPF redirection.

Revise the check back to check csum_start directly, and only if CHECKSUM_PARTIAL. Do leave the check in the updated location. Check field regardless of whether TUNNEL_CSUM is configured.