Bug 2104114 (CVE-2022-2318)

Summary:	CVE-2022-2318 Kernel: A use-after-free vulnerabilities caused by timer handler in net/rose/rose_timer.c
Product:	[Other] Security Response	Reporter:	Rohit Keshri <rkeshri>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	acaringi, adscvr, airlied, alciregi, allarkin, bhu, brdeoliv, bskeggs, chwhite, crwood, ddepaula, dhoward, dvlasenk, fhrbata, hdegoede, hkrzesin, hpa, jarod, jarodwilson, jburrell, jfaracco, jferlan, jforbes, jglisse, jlelli, joe.lawrence, jonathan, josef, jshortt, jstancek, jwboyer, jwyatt, kcarcia, kernel-maint, kernel-mgr, lgoncalv, linville, lzampier, masami256, mchehab, nmurray, ptalbert, qzhao, rvrbovsk, scweaver, steved, tyberry, vkumar, walters, williams
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	kernel 5.19 rc5	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-07-05 22:12:13 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2104006, 2105771

Description Rohit Keshri 2022-07-05 14:51:02 UTC

There are use-after-free vulnerabilities caused by timer handler in net/rose/rose_timer.c
of linux that allow attackers to crash linux kernel without any privileges.

The root cause is that del_timer() could not stop the timer handler that is running
and the refcount of sock is not managed properly in rose protocol.

The patch that have been applied to mainline Linux kernel is shown below.
https://github.com/torvalds/linux/commit/9cc02ede696272c5271a401e4f27c262359bc2f6

Comment 3 Rohit Keshri 2022-07-05 15:00:15 UTC

There was no shipped kernel version that was seen affected by this problem. These files are not built in our source code.

Comment 4 Product Security DevOps Team 2022-07-05 22:12:09 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-2318

Comment 5 Alex 2022-09-08 07:47:44 UTC

*** Bug 2117258 has been marked as a duplicate of this bug. ***