{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/dsa/dsa2.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5809fb03942dbac25144db5bebea84fa003ecaca",
              "status": "affected",
              "version": "7f2973149c22e7a6fee4c0c9fa6b8e4108e9c208",
              "versionType": "git"
            },
            {
              "lessThan": "4e0c19fcb8b5323716140fa82b79aa9f60e60407",
              "status": "affected",
              "version": "7f2973149c22e7a6fee4c0c9fa6b8e4108e9c208",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/dsa/dsa2.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: don\u0027t leak tagger-owned storage on switch driver unbind\n\nIn the initial commit dc452a471dba (\"net: dsa: introduce tagger-owned\nstorage for private and shared data\"), we had a call to\ntag_ops-\u003edisconnect(dst) issued from dsa_tree_free(), which is called at\ntree teardown time.\n\nThere were problems with connecting to a switch tree as a whole, so this\ngot reworked to connecting to individual switches within the tree. In\nthis process, tag_ops-\u003edisconnect(ds) was made to be called only from\nswitch.c (cross-chip notifiers emitted as a result of dynamic tag proto\nchanges), but the normal driver teardown code path wasn\u0027t replaced with\nanything.\n\nSolve this problem by adding a function that does the opposite of\ndsa_switch_setup_tag_protocol(), which is called from the equivalent\nspot in dsa_switch_teardown(). The positioning here also ensures that we\nwon\u0027t have any use-after-free in tagging protocol (*rcv) ops, since the\nteardown sequence is as follows:\n\ndsa_tree_teardown\n-\u003e dsa_tree_teardown_master\n   -\u003e dsa_master_teardown\n      -\u003e unsets master-\u003edsa_ptr, making no further packets match the\n         ETH_P_XDSA packet type handler\n-\u003e dsa_tree_teardown_ports\n   -\u003e dsa_port_teardown\n      -\u003e dsa_slave_destroy\n         -\u003e unregisters DSA net devices, there is even a synchronize_net()\n            in unregister_netdevice_many()\n-\u003e dsa_tree_teardown_switches\n   -\u003e dsa_switch_teardown\n      -\u003e dsa_switch_teardown_tag_protocol\n         -\u003e finally frees the tagger-owned storage"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-01T14:09:34.130Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5809fb03942dbac25144db5bebea84fa003ecaca"
        },
        {
          "url": "https://git.kernel.org/stable/c/4e0c19fcb8b5323716140fa82b79aa9f60e60407"
        }
      ],
      "title": "net: dsa: don\u0027t leak tagger-owned storage on switch driver unbind",
      "x_generator": {
        "engine": "bippy-1.1.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49808",
    "datePublished": "2025-05-01T14:09:34.130Z",
    "dateReserved": "2025-05-01T14:05:17.226Z",
    "dateUpdated": "2025-05-01T14:09:34.130Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49808\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-05-01T15:16:04.130\",\"lastModified\":\"2025-05-01T15:16:04.130\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: dsa: don\u0027t leak tagger-owned storage on switch driver unbind\\n\\nIn the initial commit dc452a471dba (\\\"net: dsa: introduce tagger-owned\\nstorage for private and shared data\\\"), we had a call to\\ntag_ops-\u003edisconnect(dst) issued from dsa_tree_free(), which is called at\\ntree teardown time.\\n\\nThere were problems with connecting to a switch tree as a whole, so this\\ngot reworked to connecting to individual switches within the tree. In\\nthis process, tag_ops-\u003edisconnect(ds) was made to be called only from\\nswitch.c (cross-chip notifiers emitted as a result of dynamic tag proto\\nchanges), but the normal driver teardown code path wasn\u0027t replaced with\\nanything.\\n\\nSolve this problem by adding a function that does the opposite of\\ndsa_switch_setup_tag_protocol(), which is called from the equivalent\\nspot in dsa_switch_teardown(). The positioning here also ensures that we\\nwon\u0027t have any use-after-free in tagging protocol (*rcv) ops, since the\\nteardown sequence is as follows:\\n\\ndsa_tree_teardown\\n-\u003e dsa_tree_teardown_master\\n   -\u003e dsa_master_teardown\\n      -\u003e unsets master-\u003edsa_ptr, making no further packets match the\\n         ETH_P_XDSA packet type handler\\n-\u003e dsa_tree_teardown_ports\\n   -\u003e dsa_port_teardown\\n      -\u003e dsa_slave_destroy\\n         -\u003e unregisters DSA net devices, there is even a synchronize_net()\\n            in unregister_netdevice_many()\\n-\u003e dsa_tree_teardown_switches\\n   -\u003e dsa_switch_teardown\\n      -\u003e dsa_switch_teardown_tag_protocol\\n         -\u003e finally frees the tagger-owned storage\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4e0c19fcb8b5323716140fa82b79aa9f60e60407\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5809fb03942dbac25144db5bebea84fa003ecaca\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}