CVE-2022-50310: ip6mr: fix UAF issue in ip6mr_sk_done() when addrconf_init_net() failed
In the Linux kernel, the following vulnerability has been resolved:
ip6mr: fix UAF issue in ip6mrskdone() when addrconfinitnet() failed
If the initialization fails in calling addrconfinitnet(), devconfall is the pointer that has been released. Then ip6mrskdone() is called to release the net, accessing devconf->mcforwarding directly causes invalid pointer access.
The process is as follows: setupnet() opsinit() addrconfinitnet() all = kmemdup(...) ---> alloc "all" ... net->ipv6.devconfall = all; addrconfsysctlregister() ---> failed ... kfree(all); ---> ipv6.devconfall invalid ... opsexitlist() ... ip6mrskdone() devconf = net->ipv6.devconfall; //devconf is invalid pointer if (!devconf || !atomicread(&devconf->mcforwarding))
The following is the Call Trace information: BUG: KASAN: use-after-free in ip6mrskdone+0x112/0x3a0 Read of size 4 at addr ffff888075508e88 by task ip/14554 Call Trace: <TASK> dumpstacklvl+0x8e/0xd1 printreport+0x155/0x454 kasanreport+0xba/0x1f0 kasancheckrange+0x35/0x1b0 ip6mrskdone+0x112/0x3a0 rawv6close+0x48/0x70 inetrelease+0x109/0x230 inet6release+0x4c/0x70 sockrelease+0x87/0x1b0 igmp6netexit+0x6b/0x170 opsexitlist+0xb0/0x170 setupnet+0x7ac/0xbd0 copynetns+0x2e6/0x6b0 createnewnamespaces+0x382/0xa50 unsharensproxynamespaces+0xa6/0x1c0 ksysunshare+0x3a4/0x7e0 x64sysunshare+0x2d/0x40 dosyscall64+0x35/0x80 entrySYSCALL64afterhwframe+0x46/0xb0 RIP: 0033:0x7f7963322547
</TASK> Allocated by task 14554: kasansavestack+0x1e/0x40 kasansettrack+0x21/0x30 kasankmalloc+0xa1/0xb0 kmallocnodetrackcaller+0x4a/0xb0 kmemdup+0x28/0x60 addrconfinitnet+0x1be/0x840 opsinit+0xa5/0x410 setupnet+0x5aa/0xbd0 copynetns+0x2e6/0x6b0 createnewnamespaces+0x382/0xa50 unsharensproxynamespaces+0xa6/0x1c0 ksysunshare+0x3a4/0x7e0 x64sysunshare+0x2d/0x40 dosyscall64+0x35/0x80 entrySYSCALL64afterhwframe+0x46/0xb0
Freed by task 14554: kasansavestack+0x1e/0x40 kasansettrack+0x21/0x30 kasansavefreeinfo+0x2a/0x40 kasanslabfree+0x155/0x1b0 slabfreefreelisthook+0x11b/0x220 kmemcachefree+0xa4/0x360 addrconfinitnet+0x623/0x840 opsinit+0xa5/0x410 setupnet+0x5aa/0xbd0 copynetns+0x2e6/0x6b0 createnewnamespaces+0x382/0xa50 unsharensproxynamespaces+0xa6/0x1c0 ksysunshare+0x3a4/0x7e0 x64sysunshare+0x2d/0x40 dosyscall64+0x35/0x80 entrySYSCALL64afterhwframe+0x46/0xb0
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-50310?
CVE-2022-50310 has been classified as a medium severity vulnerability in the Linux kernel.
How does CVE-2022-50310 affect the Linux kernel?
CVE-2022-50310 involves a use-after-free (UAF) issue in the ip6mr_sk_done() function during the address configuration initialization process.
How do I fix CVE-2022-50310?
To remediate CVE-2022-50310, users should update to the latest patched version of the Linux kernel that addresses this vulnerability.
What software versions are affected by CVE-2022-50310?
CVE-2022-50310 affects various versions of the Linux kernel prior to the implementation of the relevant fix.
What type of attack can exploit CVE-2022-50310?
CVE-2022-50310 can be exploited to potentially allow an attacker to execute arbitrary code or cause a system crash by leveraging the use-after-free condition.