CVE-2022-48651

What it actually does

Slab out-of-bounds read/write in ipvlan_xmit_mode_l2 when skb->mac_header remains at its initial value of 65535 because packet_direct_xmit bypasses the reset performed by dev_queue_xmit and packet_snd only resets the header for SOCK_RAW sockets.

Why it matters to the business

Systems using ipvlan interfaces together with AF_PACKET sockets and PACKET_QDISC_BYPASS can experience kernel memory corruption, leading to crashes, service denial, or potential local privilege escalation on Linux hosts.

How an attack unfolds

An attacker opens an AF_PACKET socket, enables PACKET_QDISC_BYPASS via setsockopt, and transmits packets over an ipvlan device; the unset mac_header value causes eth_hdr to compute an invalid address, triggering the out-of-bounds access during ipvlan_start_xmit.

How to fix it

Upgrade the Linux kernel to a version containing commit e2b46cd5796f083e452fbc624f65b80328b0c1a4 or later; rebuild and reboot with the patched ipvlan module.

How to confirm the fix worked

Confirm the presence of the fix commit in the running kernel source or binary; exercise AF_PACKET + PACKET_QDISC_BYPASS traffic against an ipvlan interface and verify no KASAN reports occur.

Typical attack path

1. Create AF_PACKET socket with appropriate protocol
2. Call setsockopt to enable PACKET_QDISC_BYPASS
3. Bind socket to ipvlan interface
4. Send packet via sendto or equivalent
5. ipvlan_xmit_mode_l2 dereferences invalid mac_header offset

How to detect it

Search kernel logs and KASAN reports for ipvlan_xmit_mode_l2 slab-out-of-bounds entries; inspect process activity creating AF_PACKET sockets followed by setsockopt PACKET_QDISC_BYPASS and traffic on ipvlan devices.

What your security team should do

• Prioritize kernel updates on any host exposing ipvlan interfaces to untrusted local processes
• Audit workloads that create AF_PACKET sockets with QDISC_BYPASS
• Monitor for kernel oops or slab corruption logs referencing ipvlan_xmit_mode_l2