CVE-2022-49727

Summary

In the Linux kernel, the following vulnerability has been resolved:

ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg

When len >= INT_MAX - transhdrlen, ulen = len + transhdrlen will be overflow. To fix, we can follow what udpv6 does and subtract the transhdrlen from the max.

Affected Software

VendorProductVersion RangeStatus
LinuxLinuxa32e0eec7042b21ccb52896cf715e3e2641fed93 < 2cf73c7cb6125083408d77f43d0e84d86aed0000affected
LinuxLinuxa32e0eec7042b21ccb52896cf715e3e2641fed93 < 0e818d433fc2718fe4da044ffca7431812a7e04eaffected
LinuxLinuxa32e0eec7042b21ccb52896cf715e3e2641fed93 < 6c4e3486d21173d60925ef52e512cae727b43d30affected
LinuxLinuxa32e0eec7042b21ccb52896cf715e3e2641fed93 < 2f42389d270f2304c8855b0b63498a5a4d0c053daffected
LinuxLinuxa32e0eec7042b21ccb52896cf715e3e2641fed93 < b8879ca1fd7348b4d5db7db86dcb97f60c73d751affected
LinuxLinuxa32e0eec7042b21ccb52896cf715e3e2641fed93 < 27a37755ceb401111ded76810359d3adc4b268a1affected
LinuxLinuxa32e0eec7042b21ccb52896cf715e3e2641fed93 < 034246122f5c5e2e2a0b9fe04e24517920e9beb1affected
LinuxLinuxa32e0eec7042b21ccb52896cf715e3e2641fed93 < f638a84afef3dfe10554c51820c16e39a278c915affected
LinuxLinux3.5affected
LinuxLinux0 < 3.5unaffected
LinuxLinux4.9.320 <= 4.9.*unaffected
LinuxLinux4.14.285 <= 4.14.*unaffected
LinuxLinux4.19.249 <= 4.19.*unaffected
LinuxLinux5.4.200 <= 5.4.*unaffected
LinuxLinux5.10.124 <= 5.10.*unaffected
LinuxLinux5.15.49 <= 5.15.*unaffected
LinuxLinux5.18.6 <= 5.18.*unaffected
LinuxLinux5.19 <= *unaffected

Weaknesses

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References