Bug 2070205 (CVE-2022-1184)
| Summary: | CVE-2022-1184 kernel: use-after-free and memory errors in ext4 when mounting and operating on a corrupted image | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Rohit Keshri <rkeshri> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | acaringi, adscvr, agk, airlied, alciregi, bhu, bskeggs, chwhite, crwood, dhoward, dvlasenk, dwd, esandeen, fhrbata, hdegoede, hkrzesin, hpa, jarod, jarodwilson, jburrell, jfaracco, jforbes, jglisse, jlelli, joe.lawrence, jonathan, josef, jshortt, jstancek, jwboyer, jwyatt, kcarcia, kernel-maint, kernel-mgr, lczerner, lgoncalv, linville, lzampier, masami256, mchehab, nmurray, ptalbert, qzhao, rvrbovsk, scweaver, security-response-team, steve.beattie, steved, swhiteho, vkumar, walters, williams |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: |
A use-after-free flaw was found in fs/ext4/namei.c:dx_insert_block() in the Linux kernel’s filesystem sub-component. This flaw allows a local attacker with a user privilege to cause a denial of service.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2022-12-05 14:34:17 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2070213, 2070214, 2070216, 2070217, 2076153 | ||
| Bug Blocks: | 2043694 | ||
|
Description
Rohit Keshri
2022-03-30 15:51:28 UTC
Created kernel tracking bugs for this issue: Affects: fedora-all [bug 2076153] FWIW a non-c reproducer is a little easier to see what's going on, it's just 2 renames that triggers it I think: #/bin/bash mkdir -p mnt mount -o loop tmp32.img mnt mv mnt/foo/bar mnt/foo/YzoUYCy4vTth45i7MwqQdVlwdwIxJa0qYmI4yG8uk1Zo4GtQAhonCZhnTxknXib3Ut7T8DLqCscG8VeGCQ3Oyi9RfuCBcnC5fIYnVrdghDwqiZ4sz6ExoNPSHZbsNnx25TnZIOFz mv mnt/foo/YzoUYCy4vTth45i7MwqQdVlwdwIxJa0qYmI4yG8uk1Zo4GtQAhonCZhnTxknXib3Ut7T8DLqCscG8VeGCQ3Oyi9RfuCBcnC5fIYnVrdghDwqiZ4sz6ExoNPSHZbsNnx25TnZIOFz mnt/foo/AIdkBBulG0Pp5lbVEIax6ccJGGdV4R1Cjextprc4p1tvlUQzkzuqbX7rnkMp9L0r0xinmKrcKkV5Ct4xsylTTtIEbc2ly2cwxIjjabLuJqxWkzTcyE4P5KehxeStg2pdKYMu7gnPWkvEkMpgYr3eBhL6Jlzxlma3JvvObin5RgI927pZwsD7YWEpFBn0wN1FGwdpdPt45BB6GyfAqqHMMTCZdxZZIaoZUPM7oF umount mnt This was fixed for Fedora with the 5.17.14 stable kernel updates. (In reply to Justin M. Forbes from comment #12) > This was fixed for Fedora with the 5.17.14 stable kernel updates. Was it? Because it's still reproducible on the recent upstream kernel. What Fedora version are we talking about so that I can test it myselt? -Lukas Just out of curiosity I've tried kernel 5.17.15 and it's also reproducible so I don't think this has been fixed in Fedora, not even by coincidence. You might be mistaking it with some other bug. This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2022:7444 https://access.redhat.com/errata/RHSA-2022:7444 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2022:7683 https://access.redhat.com/errata/RHSA-2022:7683 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2022:7933 https://access.redhat.com/errata/RHSA-2022:7933 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2022:8267 https://access.redhat.com/errata/RHSA-2022:8267 This comment was flagged a spam, view the edit history to see the original text if required. This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2022-1184 Why are not other Red Hat products such as Red Hat Enterprise Linux 7 mentioned on this CVE? It appears from the comments that it was not tested, making it unknown. I am accustomed to seeing CVEs with the full list of products saying whether or not they were affected. The needinfo request[s] on this closed bug have been removed as they have been unresolved for 120 days This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Extended Update Support Via RHSA-2024:1877 https://access.redhat.com/errata/RHSA-2024:1877 |