CVE-2022-49340: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49340 is a vulnerability in the Linux kernel's ip_gre module that was discovered and resolved in 2022. The issue affects the GRE (Generic Routing Encapsulation) implementation with TUNNEL_CSUM when handling CHECKSUM_PARTIAL packets. The vulnerability involves improper validation of csum_start after an optional skb_pull operation, which could potentially trigger an overflow in lco_csum (Kernel Git).

The vulnerability exists in the ipgre_xmit function where the original check if (csum && skb_checksum_start(skb) < skb->data) return -EINVAL had false positives when skb_checksum_start was undefined for non-CHECKSUM_PARTIAL packets. The issue specifically occurs in an uncommon GRE path that uses header_ops and calls skb_pull. The fix involves revising the check to validate csum_start directly and only when CHECKSUM_PARTIAL is set, while maintaining the check in the updated location regardless of whether TUNNEL_CSUM is configured (Kernel Git).

When exploited, this vulnerability could lead to an overflow condition in the lco_csum operation when processing GRE packets with specific checksum configurations. This could potentially affect network packet processing in systems using GRE tunneling with checksum offloading enabled (Kernel Git).

The vulnerability can be triggered through BPF redirection, where SKBs can arrive in the affected code path without the transport header set. The issue was discovered and reported by syzbot, indicating it was found through automated testing (Kernel Git).

The issue has been fixed by modifying the validation logic to properly check csum_start only when CHECKSUM_PARTIAL is set. The patch has been merged into the Linux kernel, and the fix involves changing the code to use if (skb->ip_summed == CHECKSUM_PARTIAL && skb_checksum_start(skb) < skb->data) for validation (Kernel Git).