Bug 2109926 (CVE-2022-2526)

Summary:	CVE-2022-2526 systemd-resolved: use-after-free when dealing with DnsStream in resolved-dns-stream.c
Product:	[Other] Security Response	Reporter:	Riccardo Schirone <rschiron>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	bmontgom, dtardon, eparis, fedoraproject, filbranden, flepied, jamacku, jburrell, jmigacz, lnykryn, lpoetter, michal.skrivanek, mperina, msekleta, nstielau, ryncsn, saroy, sbonazzo, security-response-team, sponnaga, ssahani, s, systemd-maint-list, systemd-maint, vkumar, yozone, yuwatana, zbyszek, zjedrzej
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	systemd 240	Doc Type:	If docs needed, set a value
Doc Text:	A use-after-free vulnerability was found in systemd. This issue occurs due to the on_stream_io() function and dns_stream_complete() function in 'resolved-dns-stream.c' not incrementing the reference counting for the DnsStream object. Therefore, other functions and callbacks called can dereference the DNSStream object, causing the use-after-free when the reference is still used later.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-09-03 04:55:48 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2110544, 2110545, 2110546, 2110547, 2110548, 2110549, 2119141, 2119142, 2123211
Bug Blocks:	2109833, 2110206

Description Riccardo Schirone 2022-07-22 13:31:03 UTC

systemd-resolved is susceptible to a Use After Free (UAF) vulnerability in how DNS packets are handled. Functions such as on_stream_io and dns_stream_complete in resolved-dns-stream.c do not increment the reference counting for the DnsStream object they are working on. Other functions and callbacks called there (e.g. on_llmnr_stream_packet) could unreference the DnsStream object, causing a Use After Free when the reference is still used later.

Upstream patch:
https://github.com/systemd/systemd/commit/d973d94dec349fb676fdd844f6fe2ada3538f27c

Comment 7 errata-xmlrpc 2022-08-24 16:44:37 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions

Via RHSA-2022:6163 https://access.redhat.com/errata/RHSA-2022:6163

Comment 8 errata-xmlrpc 2022-08-24 17:00:51 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2022:6162 https://access.redhat.com/errata/RHSA-2022:6162

Comment 9 errata-xmlrpc 2022-08-24 17:48:07 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Extended Update Support

Via RHSA-2022:6161 https://access.redhat.com/errata/RHSA-2022:6161

Comment 10 errata-xmlrpc 2022-08-24 17:53:16 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2022:6160 https://access.redhat.com/errata/RHSA-2022:6160

Comment 11 errata-xmlrpc 2022-08-29 17:13:43 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:6206 https://access.redhat.com/errata/RHSA-2022:6206

Comment 12 Sandipan Roy 2022-09-01 04:55:44 UTC

Created systemd tracking bugs for this issue:

Affects: fedora-all [bug 2123211]

Comment 15 Product Security DevOps Team 2022-09-03 04:55:45 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-2526

Comment 20 errata-xmlrpc 2022-09-19 11:50:31 UTC

This issue has been addressed in the following products:

  Red Hat Virtualization 4 for Red Hat Enterprise Linux 8

Via RHSA-2022:6551 https://access.redhat.com/errata/RHSA-2022:6551