Bug 2107924 (CVE-2022-33743)

Summary:	CVE-2022-33743 kernel: network backend may cause Linux netfront to use freed SKBs (XSA-405)
Product:	[Other] Security Response	Reporter:	Alex <allarkin>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	acaringi, adscvr, airlied, alciregi, bdettelb, bhu, brdeoliv, bskeggs, chwhite, crwood, ddepaula, dvlasenk, hdegoede, hkrzesin, hpa, jarod, jarodwilson, jburrell, jfaracco, jferlan, jforbes, jglisse, jlelli, joe.lawrence, jonathan, josef, jshortt, jstancek, jwboyer, jwyatt, kcarcia, kernel-maint, kernel-mgr, lgoncalv, linville, lzampier, masami256, mchehab, nmurray, ptalbert, qzhao, rvrbovsk, scweaver, steved, tyberry, vkumar, walters, williams
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	Linux kernel 5.19-rc6	Doc Type:	If docs needed, set a value
Doc Text:	An incomplete cleanup flaw was found in the Linux kernel’s Xen networking XDP (eXpress Data Path) subsystem. This flaw allows a local user to crash the system.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-05-09 15:48:39 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2108189, 2118313, 2118314
Bug Blocks:	2104654

Description Alex 2022-07-17 17:08:37 UTC

A flaw memory leak in the Linux Kernel XDP (eXpress Data Path) was found.
It can lead to denial of service for some specific configurations like if the non root privileged user from the host system can send malicious packets to the guest systems.
This flaw actual for the Linux Kernel versions 5.9 - 5.18.

References:
https://www.openwall.com/lists/oss-security/2022/07/05/5
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/drivers/net/xen-netfront.c?h=v5.19-rc7&id=f63c2c2032c2e3caad9add3b82cc6e91c376fd26

Comment 4 Alex 2022-07-18 14:43:18 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2108189]

Comment 5 Justin M. Forbes 2022-07-18 21:18:44 UTC

This was fixed for Fedora with the 5.18.10 stable kernel updates.

Comment 12 errata-xmlrpc 2023-05-09 07:11:26 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:2148 https://access.redhat.com/errata/RHSA-2023:2148

Comment 13 errata-xmlrpc 2023-05-09 07:50:25 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:2458 https://access.redhat.com/errata/RHSA-2023:2458

Comment 14 Product Security DevOps Team 2023-05-09 15:48:34 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-33743