CVE-2022-50885: RDMA/rxe: Fix NULL-ptr-deref in rxe_qp_do_cleanup() when socket create failed
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rxe: Fix NULL-ptr-deref in rxeqpdocleanup() when socket create failed
There is a null-ptr-deref when mount.cifs over rdma:
BUG: KASAN: null-ptr-deref in rxeqpdocleanup+0x2f3/0x360 [rdmarxe] Read of size 8 at addr 0000000000000018 by task mount.cifs/3046
CPU: 2 PID: 3046 Comm: mount.cifs Not tainted 6.1.0-rc5+ #62 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc3 Call Trace: <TASK> dumpstacklvl+0x34/0x44 kasanreport+0xad/0x130 rxeqpdocleanup+0x2f3/0x360 [rdmarxe] executeinprocesscontext+0x25/0x90 rxecleanup+0x101/0x1d0 [rdmarxe] rxecreateqp+0x16a/0x180 [rdmarxe] createqp.part.0+0x27d/0x340 ibcreateqpkernel+0x73/0x160 rdmacreateqp+0x100/0x230 smbdgetconnection+0x752/0x20f0 smbdgetconnection+0x21/0x40 cifsgettcpsession+0x8ef/0xda0 mountgetconns+0x60/0x750 cifsmount+0x103/0xd00 cifssmb3domount+0x1dd/0xcb0 smb3gettree+0x1d5/0x300 vfsgettree+0x41/0xf0 pathmount+0x9b3/0xdd0 x64sysmount+0x190/0x1d0 dosyscall64+0x35/0x80 entrySYSCALL64afterhwframe+0x46/0xb0
The root cause of the issue is the socket create failed in rxeqpinitreq().
So move the reset rxeqpdocleanup() after the NULL ptr check.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-50885?
CVE-2022-50885 has been classified with a severity level that indicates it can lead to potential system crashes due to null pointer dereference.
How do I fix CVE-2022-50885?
To fix CVE-2022-50885, ensure you are using a patched version of the Linux kernel that addresses the vulnerability.
What software is affected by CVE-2022-50885?
CVE-2022-50885 affects versions of the Linux kernel starting from 6.1.0-rc5.
What specific issue does CVE-2022-50885 address?
CVE-2022-50885 addresses a null pointer dereference issue that occurs during the cleanup of RDMA RXE objects when socket creation fails.
Is CVE-2022-50885 exploitable in production environments?
Yes, CVE-2022-50885 can be potentially exploited in production environments if the affected kernel version is in use.