CVE-2022-50780
Description
In the Linux kernel, the following vulnerability has been resolved: net: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed When the ops_init() interface is invoked to initialize the net, but ops->init() fails, data is released. However, the ptr pointer in net->gen is invalid. In this case, when nfqnl_nf_hook_drop() is invoked to release the net, invalid address access occurs. The process is as follows: setup_net() ops_init() data = kzalloc(...) ---> alloc "data" net_assign_generic() ---> assign "date" to ptr in net->gen ... ops->init() ---> failed ... kfree(data); ---> ptr in net->gen is invalid ... ops_exit_list() ... nfqnl_nf_hook_drop() *q = nfnl_queue_pernet(net) ---> q is invalid The following is the Call Trace information: BUG: KASAN: use-after-free in nfqnl_nf_hook_drop+0x264/0x280 Read of size 8 at addr ffff88810396b240 by task ip/15855 Call Trace: <TASK> dump_stack_lvl+0x8e/0xd1 print_report+0x155/0x454 kasan_report+0xba/0x1f0 nfqnl_nf_hook_drop+0x264/0x280 nf_queue_nf_hook_drop+0x8b/0x1b0 __nf_unregister_net_hook+0x1ae/0x5a0 nf_unregister_net_hooks+0xde/0x130 ops_exit_list+0xb0/0x170 setup_net+0x7ac/0xbd0 copy_net_ns+0x2e6/0x6b0 create_new_namespaces+0x382/0xa50 unshare_nsproxy_namespaces+0xa6/0x1c0 ksys_unshare+0x3a4/0x7e0 __x64_sys_unshare+0x2d/0x40 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 </TASK> Allocated by task 15855: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 __kasan_kmalloc+0xa1/0xb0 __kmalloc+0x49/0xb0 ops_init+0xe7/0x410 setup_net+0x5aa/0xbd0 copy_net_ns+0x2e6/0x6b0 create_new_namespaces+0x382/0xa50 unshare_nsproxy_namespaces+0xa6/0x1c0 ksys_unshare+0x3a4/0x7e0 __x64_sys_unshare+0x2d/0x40 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Freed by task 15855: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_save_free_info+0x2a/0x40 ____kasan_slab_free+0x155/0x1b0 slab_free_freelist_hook+0x11b/0x220 __kmem_cache_free+0xa4/0x360 ops_init+0xb9/0x410 setup_net+0x5aa/0xbd0 copy_net_ns+0x2e6/0x6b0 create_new_namespaces+0x382/0xa50 unshare_nsproxy_namespaces+0xa6/0x1c0 ksys_unshare+0x3a4/0x7e0 __x64_sys_unshare+0x2d/0x40 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0
How to fix
- Linux Linux5a2ea549be94924364f6911227d99be86e8cf34a, 97ad240fd9aa9214497d14af2b91608e20856cac, c3edc6e808209aa705185f732e682a370981ced1, a1e18acb0246bfb001b08b8b1b830b5ec92a0f13, 4a4df5e78712de39d6f90d6a64b5eb48dca03bd5, d266935ac43d57586e311a087510fe6a084af742 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | f875bae065334907796da12523f9df85c89f5712 ≤ v < 5a2ea549be94924364f6911227d99be86e8cf34a, f875bae065334907796da12523f9df85c89f5712 ≤ v < 97ad240fd9aa9214497d14af2b91608e20856cac, f875bae065334907796da12523f9df85c89f5712 ≤ v < c3edc6e808209aa705185f732e682a370981ced1, f875bae065334907796da12523f9df85c89f5712 ≤ v < a1e18acb0246bfb001b08b8b1b830b5ec92a0f13, f875bae065334907796da12523f9df85c89f5712 ≤ v < 4a4df5e78712de39d6f90d6a64b5eb48dca03bd5, f875bae065334907796da12523f9df85c89f5712 ≤ v < d266935ac43d57586e311a087510fe6a084af742, 2.6.33 | 5a2ea549be94924364f6911227d99be86e8cf34a, 97ad240fd9aa9214497d14af2b91608e20856cac, c3edc6e808209aa705185f732e682a370981ced1, a1e18acb0246bfb001b08b8b1b830b5ec92a0f13, 4a4df5e78712de39d6f90d6a64b5eb48dca03bd5, d266935ac43d57586e311a087510fe6a084af742 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.