CVE-2022-49086

In the Linux kernel, the following vulnerability has been resolved:

net: openvswitch: fix leak of nested actions

While parsing user-provided actions, openvswitch module may dynamically allocate memory and store pointers in the internal copy of the actions. So this memory has to be freed while destroying the actions.

Currently there are only two such actions: ct() and set(). However, there are many actions that can hold nested lists of actions and ovs_nla_free_flow_actions() just jumps over them leaking the memory.

For example, removal of the flow with the following actions will lead to a leak of the memory allocated by nf_ct_tmpl_alloc():

actions:clone(ct(commit),0)

Non-freed set() action may also leak the dst structure for the tunnel info including device references.

Under certain conditions with a high rate of flow rotation that may cause significant memory leak problem (2MB per second in reporters case). The problem is also hard to mitigate, because the user doesnt have direct control over the datapath flows generated by OVS.

Fix that by iterating over all the nested actions and freeing everything that needs to be freed recursively.

New build time assertion should protect us from this problem if new actions will be added in the future.

Unfortunately, openvswitch module doesnt use NLA_F_NESTED, so all attributes has to be explicitly checked. sample() and clone() actions are mixing extra attributes into the user-provided action list. That prevents some code generalization too.

Weakness

The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Affected Software

Potential Mitigations

• Choose a language or tool that provides automatic memory management, or makes manual memory management less error-prone.
• For example, glibc in Linux provides protection against free of invalid pointers.
• When using Xcode to target OS X or iOS, enable automatic reference counting (ARC) [REF-391].
• To help correctly and consistently manage memory when programming in C++, consider using a smart pointer class such as std::auto_ptr (defined by ISO/IEC ISO/IEC 14882:2003), std::shared_ptr and std::unique_ptr (specified by an upcoming revision of the C++ standard, informally referred to as C++ 1x), or equivalent solutions such as Boost.

References

• https://git.kernel.org/stable/c/1f30fb9166d4f15a1aa19449b9da871fe0ed4796
• https://git.kernel.org/stable/c/3554c214b83ec9a839ed574263a34218f372990c
• https://git.kernel.org/stable/c/53bce9d19b0a9d245b25cd050b81652ed974a509
• https://git.kernel.org/stable/c/5ae05b5eb58773cfec307ff88aff4cfd843c4cff
• https://git.kernel.org/stable/c/7438dc55c0709819b813f4778aec2c48b782990b
• https://git.kernel.org/stable/c/837b96d8103938e35e7d92cd9db96af914ca4fff
• https://git.kernel.org/stable/c/ef6f9ce0a79aa23b10fc5f3b3cab3814a25aac40