Bug 2056381 (CVE-2022-1195)

Summary: CVE-2022-1195 kernel: A possible race condition (use-after-free) in drivers/net/hamradio/6pack ( mkiss.c) after unregister_netdev
Product: [Other] Security Response Reporter: TEJ RATHI <trathi>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED WONTFIX QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: acaringi, adscvr, airlied, alciregi, allarkin, bdettelb, bhu, bskeggs, chwhite, crwood, dhoward, dvlasenk, fhrbata, hdegoede, hkrzesin, jarod, jarodwilson, jburrell, jeremy, jfaracco, jforbes, jglisse, jlelli, joe.lawrence, jonathan, josef, jshortt, jstancek, jwboyer, jwyatt, kcarcia, kernel-maint, kernel-mgr, lgoncalv, linville, lzampier, masami256, mchehab, nmurray, ptalbert, qzhao, rkeshri, rvrbovsk, scweaver, steved, vkumar, walters, williams, zulinx86
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: kernel 5.16 rc1 Doc Type: If docs needed, set a value
Doc Text:
A use-after-free vulnerability was found in the Linux kernel in drivers/net/hamradio. This flaw allows a local attacker with a user privilege to cause a denial of service (DOS) when the mkiss or sixpack device is detached and reclaim resources early.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2022-08-25 10:33:38 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2070572, 2070573    
Bug Blocks: 2056384, 2070627, 2141373    

Description TEJ RATHI 2022-02-21 06:18:32 UTC 
A use-after-free vulnerability was found in drivers/net/hamradio in the Linux kernel. In this flaw, a local attacker with a user privilege may lead to a denial of service (DOS) problem, when mkiss or sixpack device is detached, and reclaim resources early.

Reference:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b2f37aead1b82a770c48b5d583f35ec22aabb61e
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=81b1d548d00bcd028303c4f3150fa753b9b8aa71
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0b9111922b1f399aba6ed1e1b8f2079c3da1aed8
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3e0588c291d6ce225f2b891753ca41d45ba42469


==================================================================
[   26.882075] BUG: KASAN: use-after-free in
tty_insert_flip_string_fixed_flag+0xd8/0x1e0
[   26.882075] Read of size 85 at addr ffff88800690d000 by task trigger/141
[   26.882075]
[   26.882075] CPU: 3 PID: 141 Comm: trigger Not tainted 5.11.0 #6
[   26.882075] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
[   26.882075] Call Trace:
[   26.882075]  dump_stack+0x7d/0xa3
[   26.882075]  print_address_description.constprop.0+0x18/0x130
[   26.882075]  ? tty_insert_flip_string_fixed_flag+0xd8/0x1e0
[   26.882075]  ? tty_insert_flip_string_fixed_flag+0xd8/0x1e0
[   26.882075]  kasan_report.cold+0x7f/0x10e
[   26.882075]  ? tty_insert_flip_string_fixed_flag+0xd8/0x1e0
[   26.882075]  check_memory_region+0xf9/0x1e0
[   26.882075]  memcpy+0x20/0x60
[   26.882075]  tty_insert_flip_string_fixed_flag+0xd8/0x1e0
[   26.882075]  pty_write+0xfa/0x1b0
[   26.882075]  ? pty_set_termios+0x5d0/0x5d0
[   26.882075]  ax_encaps+0x9c9/0xb60
[   26.882075]  ax_xmit+0x36a/0x37e
[   26.882075]  dev_hard_start_xmit+0x160/0x500
[   26.882075]  sch_direct_xmit+0x20b/0xa00
[   26.882075]  ? qdisc_put_unlocked+0x50/0x50
[   26.882075]  ? sysvec_apic_timer_interrupt+0x33/0xd0
[   26.882075]  ? pfifo_fast_dequeue+0x275/0xa30
[   26.882075]  __qdisc_run+0x3a0/0x1390
[   26.882075]  __dev_queue_xmit+0xabb/0x1b10
[   26.882075]  ? netdev_core_pick_tx+0x2a0/0x2a0
[   26.882075]  ? sysvec_apic_timer_interrupt+0x33/0xd0
[   26.882075]  ? memcpy+0x39/0x60
[   26.882075]  ? ax25_addr_build+0x7e/0x2a0
[   26.882075]  ax25_sendmsg+0xb70/0x1090
[   26.882075]  ? selinux_inode_notifysecctx+0x20/0x20
[   26.882075]  ? ax25_device_event+0x210/0x210
[   26.882075]  ? __fget_files+0x15b/0x210
[   26.882075]  ? ax25_device_event+0x210/0x210
[   26.882075]  sock_sendmsg+0xdf/0x110
[   26.882075]  __sys_sendto+0x19e/0x270
[   26.882075]  ? __ia32_sys_getpeername+0xa0/0xa0
[   26.882075]  ? copy_init_fpstate_to_fpregs+0x70/0x70
[   26.882075]  __x64_sys_sendto+0xd8/0x1b0
[   26.882075]  ? exit_to_user_mode_prepare+0x2c/0x120
[   26.882075]  do_syscall_64+0x33/0x40
[   26.882075]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
<..>
==================================================================
Comment 1 Rohit Keshri 2022-03-31 12:12:14 UTC 
*** Bug 2056382 has been marked as a duplicate of this bug. ***
Comment 7 Rohit Keshri 2022-03-31 13:31:53 UTC 
There was no shipped kernel version that was seen affected by this problem. These files are not built in our source code.
Comment 11 Alex 2022-11-10 14:04:34 UTC 
*** Bug 2141676 has been marked as a duplicate of this bug. ***