Bug 2070689 (CVE-2022-1198)

Summary: CVE-2022-1198 kernel: use-after-free in drivers/net/hamradio/6pack.c
Product: [Other] Security Response Reporter: Pedro Sampaio <psampaio>
Component: vulnerabilityAssignee: Nobody <nobody>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: acaringi, adscvr, airlied, alciregi, bdettelb, bhu, carnil, chwhite, crwood, dvlasenk, hdegoede, hkrzesin, hpa, jarod, jarodwilson, jburrell, jfaracco, jforbes, jglisse, jlelli, joe.lawrence, jonathan, josef, jshortt, jstancek, jwboyer, jwyatt, kcarcia, kernel-maint, kernel-mgr, lgoncalv, linville, lzampier, masami256, mchehab, nmurray, ptalbert, qzhao, rvrbovsk, scweaver, steved, vkumar, walters, williams
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: kernel 5.17 rc6 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2071041, 2089036, 2089037    
Bug Blocks: 2070690, 2070693    

Description Pedro Sampaio 2022-03-31 16:52:44 UTC
There are use-after-free vulnerabilities in drivers/net/hamradio/6pack.c of linux that allow attacker to crash linux kernel by simulating Amateur Radio from user-space.

Upstream fix:

https://github.com/torvalds/linux/commit/efe4186e6a1b54bf38b9e05450d43b0da1fd7739

Comment 1 Pedro Sampaio 2022-04-01 16:33:20 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2071041]

Comment 2 Salvatore Bonaccorso 2022-04-02 12:00:46 UTC
https://www.openwall.com/lists/oss-security/2022/04/02/3

Comment 3 Justin M. Forbes 2022-04-28 12:42:05 UTC
This was fixed for Fedora with the 5.16.15 stable kernel updates.

Comment 4 TEJ RATHI 2022-05-10 08:16:53 UTC
*** Bug 2070691 has been marked as a duplicate of this bug. ***