CVE-2022-2526: Use After Free
A use-after-free vulnerability was found in systemd. This issue occurs due to the onstreamio() function and dnsstreamcomplete() function in 'resolved-dns-stream.c' not incrementing the reference counting for the DnsStream object. Therefore, other functions and callbacks called can dereference the DNSStream object, causing the use-after-free when the reference is still used later.
Other sources
systemd could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free flaw due to the onstreamio() function and dnsstreamcomplete() function in "resolved-dns-stream.c" not incrementing the reference counting for the DnsStream object. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the system.
— IBM
systemd-resolved is susceptible to a Use After Free (UAF) vulnerability in how DNS packets are handled. Functions such as onstreamio and dnsstreamcomplete in resolved-dns-stream.c do not increment the reference counting for the DnsStream object they are working on. Other functions and callbacks called there (e.g. onllmnrstreampacket) could unreference the DnsStream object, causing a Use After Free when the reference is still used later.
Upstream patch: https://github.com/systemd/systemd/commit/d973d94dec349fb676fdd844f6fe2ada3538f27c
— Red Hat
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2022-2526?
The severity of CVE-2022-2526 is critical.
How does CVE-2022-2526 occur?
CVE-2022-2526 occurs due to a use-after-free vulnerability in systemd.
Which functions in systemd are affected by CVE-2022-2526?
The on_stream_io() function and dns_stream_complete() function in 'resolved-dns-stream.c' are affected by CVE-2022-2526.
Which versions of systemd are affected by CVE-2022-2526?
The versions affected by CVE-2022-2526 include systemd 240, 0:219-78.el7_9.7, 0:239-58.el8_6.4, 0:239-18.el8_1, 0:239-31.el8_2, and 0:239-45.el8_4.12.
How can I fix CVE-2022-2526?
To fix CVE-2022-2526, you need to update systemd to version 240 or apply the appropriate remedy provided by the package distributor.