Bug 2049040

Summary:	CVE-2022-24122 kernel: Backport fixes for ucount rlimits
Product:	Red Hat Enterprise Linux 9	Reporter:	Alexey Gladkov <agladkov>
Component:	kernel	Assignee:	Alexey Gladkov <agladkov>
kernel sub component:	Namespace	QA Contact:	Chao Ye <cye>
Status:	CLOSED ERRATA	Docs Contact:
Severity:	unspecified
Priority:	unspecified	CC:	agladkov, bhu, cye, ebiederm, hkrzesin, llong, pvlasin, rkeshri
Version:	9.0	Keywords:	Triaged
Target Milestone:	rc
Target Release:	9.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	kernel-5.14.0-70.el9	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-05-17 15:45:26 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2048492, 2048626
Deadline:	2022-02-14

Description Alexey Gladkov 2022-02-01 11:40:21 UTC

We need to backport the fixes for ucounts including UAF in shm code.

f9d87929d451d3e649699d0f1d74f71f77ad38f5 ucount:  Make get_ucount a safe get_user replacement
59ec71575ab440cd5ca0aa53b2a2985b3639fad4 ucounts: Fix rlimit max values check
32342701b4ba57a6fd77e8aca2f65f68c0fa1da6 ucounts: Use atomic_long_sub_return for clarity
da70d3109e74adf6ae9f8d1f6c7c0c9735d314ba ucounts: Add get_ucounts_or_wrap for clarity
5fc9e37cd5ae762b856912cdedb226a884b3c3e0 ucounts: Remove unnecessary test for NULL ucount in get_ucounts

Comment 2 Chris von Recklinghausen 2022-02-11 11:06:57 UTC

*** Bug 2048624 has been marked as a duplicate of this bug. ***

Comment 17 Chao Ye 2022-02-23 07:55:12 UTC

Namespace test pass with kernel-5.14.0-51.mr463_220201_1415.el9:
https://beaker.engineering.redhat.com/jobs/6332294

Comment 22 Chao Ye 2022-03-02 04:49:07 UTC

Namespace test pass with kernel-5.14.0-70.el9:
https://beaker.engineering.redhat.com/jobs/6356781

Comment 24 errata-xmlrpc 2022-05-17 15:45:26 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (new packages: kernel), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:3907