CVE-2022-49017: tipc: re-fetch skb cb after tipc_msg_validate
In the Linux kernel, the following vulnerability has been resolved:
tipc: re-fetch skb cb after tipcmsgvalidate
As the call trace shows, the original skb was freed in tipcmsgvalidate(), and dereferencing the old skb cb would cause an use-after-free crash.
BUG: KASAN: use-after-free in tipccryptorcvcomplete+0x1835/0x2240 [tipc] Call Trace: <IRQ> tipccryptorcvcomplete+0x1835/0x2240 [tipc] tipccryptorcv+0xd32/0x1ec0 [tipc] tipcrcv+0x744/0x1150 [tipc] ... Allocated by task 47078: kmemcacheallocnode+0x158/0x4d0 allocskb+0x1c1/0x270 tipcbufacquire+0x1e/0xe0 [tipc] tipcmsgcreate+0x33/0x1c0 [tipc] tipclinkbuildprotomsg+0x38a/0x2100 [tipc] tipclinktimeout+0x8b8/0xef0 [tipc] tipcnodetimeout+0x2a1/0x960 [tipc] calltimerfn+0x2d/0x1c0 ... Freed by task 47078: tipcmsgvalidate+0x7b/0x440 [tipc] tipccryptorcvcomplete+0x4b5/0x2240 [tipc] tipccryptorcv+0xd32/0x1ec0 [tipc] tipcrcv+0x744/0x1150 [tipc]
This patch fixes it by re-fetching the skb cb from the new allocated skb after calling tipcmsgvalidate().
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-49017?
CVE-2022-49017 has a severity rating classified as high due to the potential for use-after-free crashes in the Linux kernel.
How do I fix CVE-2022-49017?
To fix CVE-2022-49017, update the Linux kernel to a version that includes the patch addressing this vulnerability.
What versions of the Linux kernel are affected by CVE-2022-49017?
CVE-2022-49017 affects Linux kernel versions from 5.5 to 5.10.158, 5.11 to 5.15.82, and 5.16 to 6.0.12, as well as various release candidates in the 6.1 series.
What causes the vulnerability described in CVE-2022-49017?
CVE-2022-49017 is caused by dereferencing an old socket buffer control block after it has been freed, resulting in a use-after-free condition.
Can CVE-2022-49017 be exploited remotely?
Exploitation of CVE-2022-49017 would typically require local access to the vulnerable system, as it involves interacting with the kernel directly.