Bug 2104114 (CVE-2022-2318) - CVE-2022-2318 Kernel: A use-after-free vulnerabilities caused by timer handler in net/rose/rose_timer.c
Summary: CVE-2022-2318 Kernel: A use-after-free vulnerabilities caused by timer handle...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2022-2318
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
: 2117258 (view as bug list)
Depends On:
Blocks: 2104006 2105771
TreeView+ depends on / blocked
 
Reported: 2022-07-05 14:51 UTC by Rohit Keshri
Modified: 2023-03-14 18:28 UTC (History)
50 users (show)

Fixed In Version: kernel 5.19 rc5
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2022-07-05 22:12:13 UTC
Embargoed:

Attachments (Terms of Use)

Description Rohit Keshri 2022-07-05 14:51:02 UTC 
There are use-after-free vulnerabilities caused by timer handler in net/rose/rose_timer.c
of linux that allow attackers to crash linux kernel without any privileges.

The root cause is that del_timer() could not stop the timer handler that is running
and the refcount of sock is not managed properly in rose protocol.

The patch that have been applied to mainline Linux kernel is shown below.
https://github.com/torvalds/linux/commit/9cc02ede696272c5271a401e4f27c262359bc2f6
Comment 3 Rohit Keshri 2022-07-05 15:00:15 UTC 
There was no shipped kernel version that was seen affected by this problem. These files are not built in our source code.
Comment 4 Product Security DevOps Team 2022-07-05 22:12:09 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-2318
Comment 5 Alex 2022-09-08 07:47:44 UTC 
*** Bug 2117258 has been marked as a duplicate of this bug. ***
Note You need to log in before you can comment on or make changes to this bug.