CVE-2022-2961: Use After Free
A flaw use after free in the Linux Kernel found in the Amateur Radio X.25 Packet Layer Protocol (PLP Rose).
The bug is race condition inside rosebind() function. The rosebind() binds an sk and a given address, and then adds the sk to roselist via roseinsertsocket(). Since there is no locksock() in rosebind(), a user can call rosebind() from two threads at the same moment, and the victim sk is possible to be added to roselist twice.
If the race is succeed, sk->sknode.next will point to sk itself, which makes it become a cycle, and the sk's refcount is one more than the normal case. When releasing the sk, according to rosedestroysocket(), roseremovesocket() is called multiple times which is up to skhasallocations(). If skhasallocations() returns false the first time, sk won't be freed and cause a memory leak. Otherwise, sk is freed but can still be accessed via roselist, which causes a use-after-free. An attacker is able to leak kernel information from /proc/net/rose and do local privilege escalation in other ways.
Tested it on Linux-5.17.rc5.
Other sources
A use-after-free flaw was found in the Linux kernel’s PLP Rose functionality in the way a user triggers a race condition by calling bind while simultaneously triggering the rosebind() function. This flaw allows a local user to crash or potentially escalate their privileges on the system.
— Ubuntu
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/Linux kernelto a version that resolves this vulnerability.Fixed in 6.0
Event History
Frequently Asked Questions
What is CVE-2022-2961?
CVE-2022-2961 is a use-after-free vulnerability in the Linux kernel's PLP Rose functionality that allows a local user to crash or potentially escalate privileges.
Which software is affected by CVE-2022-2961?
The Linux kernel versions up to and including 6.0 and Fedora 36 are affected by CVE-2022-2961.
How severe is CVE-2022-2961?
CVE-2022-2961 has a severity rating of high (7 out of 10).
How can I fix CVE-2022-2961?
Apply the necessary updates or patches provided by the Linux kernel or Fedora to fix CVE-2022-2961.
Where can I find more information about CVE-2022-2961?
You can find more information about CVE-2022-2961 on the Red Hat and NetApp security advisories provided in the references: [Red Hat Advisory](https://access.redhat.com/security/cve/CVE-2022-2961) and [NetApp Advisory](https://security.netapp.com/advisory/ntap-20230214-0004/).