CVE-2022-49456: bonding: fix missed rcu protection
In the Linux kernel, the following vulnerability has been resolved:
bonding: fix missed rcu protection
When removing the rcureadlock in bondethtoolgettsinfo() as discussed [1], I didn't notice it could be called via setsockopt, which doesn't hold rcu lock, as syzbot pointed:
stack backtrace: CPU: 0 PID: 3599 Comm: syz-executor317 Not tainted 5.18.0-rc5-syzkaller-01392-g01f4685797a5 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: <TASK> dumpstack lib/dumpstack.c:88 [inline] dumpstacklvl+0xcd/0x134 lib/dumpstack.c:106 bondoptionactiveslavegetrcu include/net/bonding.h:353 [inline] bondethtoolgettsinfo+0x32c/0x3a0 drivers/net/bonding/bondmain.c:5595 ethtoolgettsinfo+0x173/0x240 net/ethtool/common.c:554 ethtoolgetphcvclocks+0x99/0x110 net/ethtool/common.c:568 socktimestampingbindphc net/core/sock.c:869 [inline] socksettimestamping+0x3a3/0x7e0 net/core/sock.c:916 socksetsockopt+0x543/0x2ec0 net/core/sock.c:1221 syssetsockopt+0x55e/0x6a0 net/socket.c:2223 dosyssetsockopt net/socket.c:2238 [inline] sesyssetsockopt net/socket.c:2235 [inline] x64syssetsockopt+0xba/0x150 net/socket.c:2235 dosyscallx64 arch/x86/entry/common.c:50 [inline] dosyscall64+0x35/0xb0 arch/x86/entry/common.c:80 entrySYSCALL64afterhwframe+0x44/0xae RIP: 0033:0x7f8902c8eb39
Fix it by adding rcureadlock and take a ref on the realdev. Since devhold() and devput() can take NULL these days, we can skip checking if realdev exist.
[1] https://lore.kernel.org/netdev/27565.1642742439@famine/
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to trigger this issue?
The supplied severity vector indicates local attack access, low attack complexity, low privileges required, and no user interaction. The affected path is reachable through a setsockopt call involving socket timestamping.
Which systems are most relevant to triage?
Systems running the Linux kernel with bonding configured are the relevant population, because the vulnerable function is in the bonding driver. The data does not identify specific affected kernel versions.
What is the impact if exploitation succeeds?
The provided vector rates confidentiality, integrity, and availability impact as high. The scope is listed as unchanged.
What should be checked to assess exposure?
Check whether the running Linux kernel includes one of the referenced stable fixes: 1b66a533c47d29b38af8e05fbb53b609a5ba3a4e, 85eed460681da71b359ed906bce4d800081db854, or 9b80ccda233fa6c59de411bf889cc4d0e028f2c7. Also determine whether bonding is in use and whether local low-privilege users can invoke the relevant socket options.