CVE-2022-1011: Use After Free
First published: Mon Mar 07 2022(Updated: )
A flaw in the Linux Kernel found. If unprivileged users can mount FUSE filesystems, then can trigger use after free (UAF) that reads of write() buffers, allowing theft of (partial) /etc/shadow hashes or any other data from filesystem. FUSE allows the userspace filesystem to specify on FUSE_OPEN whether the file should use the normal kernel pagecache for handling read()/write() or just send FUSE_READ/FUSE_WRITE requests directly to the userspace filesystem (using the flag FOPEN_DIRECT_IO in fuse_open_out::open_flags). In FOPEN_DIRECT_IO mode, fuse_file_write_iter() calls fuse_direct_write_iter(), which normally calls fuse_direct_io(), which then imports the write buffer with fuse_get_user_pages(), which uses iov_iter_get_pages() to grab references to userspace pages instead of actually copying memory. On the filesystem device side, these pages can then either be read to userspace (via fuse_dev_read()), or splice()d over into a pipe using fuse_dev_splice_read() as pipe buffers with &nosteal_pipe_buf_ops. This is wrong because after fuse_dev_do_read() unlocks the FUSE request, the userspace filesystem can mark the request as completed, causing write() to return. At that point, the write buffer may be reused for other purposes, and the userspace filesystem should no longer have access to it.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/kernel-rt | <0:4.18.0-372.9.1.rt7.166.el8 | 0:4.18.0-372.9.1.rt7.166.el8 |
| redhat/kernel | <0:4.18.0-372.9.1.el8 | 0:4.18.0-372.9.1.el8 |
| redhat/Linux kernel | <5.16 | 5.16 |
| Linux Kernel | <5.17 | |
| Linux Kernel | =5.17 | |
| Linux Kernel | =5.17-rc1 | |
| Linux Kernel | =5.17-rc2 | |
| Linux Kernel | =5.17-rc3 | |
| Linux Kernel | =5.17-rc4 | |
| Linux Kernel | =5.17-rc7 | |
| Fedoraproject Fedora | =34 | |
| Fedoraproject Fedora | =35 | |
| Red Hat Build of Quarkus | =2.0 | |
| redhat developer tools | =1.0 | |
| Red Hat Enterprise Linux | =6.0 | |
| Red Hat Enterprise Linux | =7.0 | |
| Red Hat Enterprise Linux | =8.0 | |
| redhat enterprise Linux eus | =8.6 | |
| redhat enterprise Linux for ibm z systems | =8.0 | |
| redhat enterprise Linux for ibm z systems eus | =8.6 | |
| redhat enterprise Linux for power little endian | =8.0 | |
| redhat enterprise Linux for power little endian eus | =8.6 | |
| redhat enterprise Linux for real time | =8 | |
| redhat enterprise Linux for real time for nfv | =8 | |
| redhat enterprise Linux for real time for nfv tus | =8.6 | |
| redhat enterprise Linux for real time tus | =8.6 | |
| redhat enterprise Linux server aus | =8.6 | |
| redhat enterprise Linux server for power little endian update services for sap solutions | =8.6 | |
| redhat enterprise Linux server tus | =8.6 | |
| redhat enterprise Linux server update services for sap solutions | =8.6 | |
| All of | ||
| redhat virtualization host | =4.0 | |
| Red Hat Enterprise Linux | =8.0 | |
| All of | ||
| redhat codeready Linux builder | ||
| Any of | ||
| Red Hat Enterprise Linux | =8.0 | |
| Red Hat Enterprise Linux | =8.6 | |
| redhat enterprise Linux eus | =8.6 | |
| redhat enterprise Linux for power little endian | =8.0 | |
| redhat enterprise Linux for power little endian eus | =8.6 | |
| All of | ||
| netapp h300s firmware | ||
| netapp h300s | ||
| All of | ||
| NetApp H500S Firmware | ||
| netapp h500s | ||
| All of | ||
| netapp h700s firmware | ||
| netapp h700s | ||
| All of | ||
| netapp h300e firmware | ||
| netapp h300e | ||
| All of | ||
| netapp h500e firmware | ||
| netapp h500e | ||
| All of | ||
| netapp h700e firmware | ||
| netapp h700e | ||
| All of | ||
| netapp h410s firmware | ||
| netapp h410s | ||
| All of | ||
| netapp h410c firmware | ||
| netapp h410c | ||
| Debian Debian Linux | =9.0 | |
| Debian Debian Linux | =10.0 | |
| oracle communications Cloud native core binding support function | =22.1.3 | |
| redhat virtualization host | =4.0 | |
| Red Hat Enterprise Linux | =8.0 | |
| redhat codeready Linux builder | ||
| Red Hat Enterprise Linux | =8.6 | |
| redhat enterprise Linux eus | =8.6 | |
| redhat enterprise Linux for power little endian | =8.0 | |
| redhat enterprise Linux for power little endian eus | =8.6 | |
| netapp h300s firmware | ||
| netapp h300s | ||
| NetApp H500S Firmware | ||
| netapp h500s | ||
| netapp h700s firmware | ||
| netapp h700s | ||
| netapp h300e firmware | ||
| netapp h300e | ||
| netapp h500e firmware | ||
| netapp h500e | ||
| netapp h700e firmware | ||
| netapp h700e | ||
| netapp h410s firmware | ||
| netapp h410s | ||
| netapp h410c firmware | ||
| netapp h410c | ||
| debian/linux | 5.10.223-1 5.10.226-1 6.1.123-1 6.1.119-1 6.12.10-1 6.12.11-1 |
Remedy
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2022-1011 https://nvd.nist.gov/vuln/detail/CVE-2022-1011 https://lore.kernel.org/lkml/20220414110839.241541230@linuxfoundation.org/
- https://bugzilla.redhat.com/show_bug.cgi?id=2064855
- https://access.redhat.com/errata/RHSA-2022:1975
- https://access.redhat.com/errata/RHSA-2022:1988
- https://access.redhat.com/security/cve/cve-2022-1011
- https://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse.git/commit/?h=for-next
- https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html
- https://www.debian.org/security/2022/dsa-5173
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://launchpad.net/bugs/cve/CVE-2022-1011
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2065331
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2082384
- https://access.redhat.com/errata/RHSA-2024:5259
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1011
- https://nvd.nist.gov/vuln/detail/CVE-2022-1011
- https://security-tracker.debian.org/tracker/CVE-2022-1011
- https://ubuntu.com/security/CVE-2022-1011
- https://git.kernel.org/linus/0c4bcfdecb1ac0967619ee7ff44871d93c08c909
- collector/redhat-cve
- agent/type
- collector/launchpad-cve
- source/Launchpad
- agent/first-publish-date
- agent/author
- agent/severity
- agent/weakness
- collector/mitre-cve
- source/MITRE
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2022-1011
- agent/software-canonical-lookup
- collector/usn-cve
- source/Ubuntu
- agent/last-modified-date
- agent/references
- agent/remedy
- agent/description
- agent/event
- agent/trending
- agent/source
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-index
- agent/tags
- agent/softwarecombine
- collector/security-tracker-debian
- source/Debian
- package-manager/redhat
- vendor/linux
- canonical/linux kernel
- version/linux kernel/5.17
- version/linux kernel/5.17-rc1
- version/linux kernel/5.17-rc2
- version/linux kernel/5.17-rc3
- version/linux kernel/5.17-rc4
- version/linux kernel/5.17-rc7
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/34
- version/fedoraproject fedora/35
- vendor/redhat
- canonical/red hat build of quarkus
- version/red hat build of quarkus/2.0
- canonical/redhat developer tools
- version/redhat developer tools/1.0
- canonical/red hat enterprise linux
- version/red hat enterprise linux/6.0
- version/red hat enterprise linux/7.0
- version/red hat enterprise linux/8.0
- canonical/redhat enterprise linux eus
- version/redhat enterprise linux eus/8.6
- canonical/redhat enterprise linux for ibm z systems
- version/redhat enterprise linux for ibm z systems/8.0
- canonical/redhat enterprise linux for ibm z systems eus
- version/redhat enterprise linux for ibm z systems eus/8.6
- canonical/redhat enterprise linux for power little endian
- version/redhat enterprise linux for power little endian/8.0
- canonical/redhat enterprise linux for power little endian eus
- version/redhat enterprise linux for power little endian eus/8.6
- canonical/redhat enterprise linux for real time
- version/redhat enterprise linux for real time/8
- canonical/redhat enterprise linux for real time for nfv
- version/redhat enterprise linux for real time for nfv/8
- canonical/redhat enterprise linux for real time for nfv tus
- version/redhat enterprise linux for real time for nfv tus/8.6
- canonical/redhat enterprise linux for real time tus
- version/redhat enterprise linux for real time tus/8.6
- canonical/redhat enterprise linux server aus
- version/redhat enterprise linux server aus/8.6
- canonical/redhat enterprise linux server for power little endian update services for sap solutions
- version/redhat enterprise linux server for power little endian update services for sap solutions/8.6
- canonical/redhat enterprise linux server tus
- version/redhat enterprise linux server tus/8.6
- canonical/redhat enterprise linux server update services for sap solutions
- version/redhat enterprise linux server update services for sap solutions/8.6
- canonical/redhat virtualization host
- version/redhat virtualization host/4.0
- canonical/redhat codeready linux builder
- version/red hat enterprise linux/8.6
- vendor/netapp
- canonical/netapp h300s firmware
- canonical/netapp h300s
- canonical/netapp h500s firmware
- canonical/netapp h500s
- canonical/netapp h700s firmware
- canonical/netapp h700s
- canonical/netapp h300e firmware
- canonical/netapp h300e
- canonical/netapp h500e firmware
- canonical/netapp h500e
- canonical/netapp h700e firmware
- canonical/netapp h700e
- canonical/netapp h410s firmware
- canonical/netapp h410s
- canonical/netapp h410c firmware
- canonical/netapp h410c
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/9.0
- version/debian debian linux/10.0
- vendor/oracle
- canonical/oracle communications cloud native core binding support function
- version/oracle communications cloud native core binding support function/22.1.3
- package-manager/debian