Bug 2142371 (CVE-2022-3977)

Summary:	CVE-2022-3977 kernel: use-after-free bug in mctp_sk_unhash in net/mctp/af_mctp.c
Product:	[Other] Security Response	Reporter:	Alex <allarkin>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	acaringi, adscvr, airlied, alciregi, bhu, brdeoliv, bskeggs, chwhite, crwood, ctoe, ddepaula, debarbos, dhoward, dvlasenk, ezulian, fhrbata, hdegoede, hkrzesin, hpa, jarod, jarodwilson, jburrell, jfaracco, jferlan, jforbes, jglisse, jlelli, joe.lawrence, jonathan, josef, jpoimboe, jshortt, jstancek, jwboyer, jwyatt, kcarcia, kernel-maint, kernel-mgr, kpatch-maint, lgoncalv, linville, lleshchi, lzampier, masami256, mchehab, nmurray, ptalbert, qzhao, rhandlin, rvrbovsk, scweaver, steved, tyberry, vkumar, walters, williams, ycote
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	Linux kernel 6.1-rc1	Doc Type:	If docs needed, set a value
Doc Text:	A use-after-free flaw was found in the Linux kernel MCTP (Management Component Transport Protocol) functionality. This issue occurs when a user simultaneously calls DROPTAG ioctl and socket close happens, which could allow a local user to crash the system or potentially escalate their privileges on the system.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-12-04 13:03:53 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2134114

Description Alex 2022-11-13 13:34:49 UTC

A flaw use after free found in the Linux Kernel MCTP (Management Component Transport Protocol) implementation.
Starting from Kernel version 5.18.0, after commit 63ed1aab3d40aa61aaa66819bdce9377ac7f40fa that introduces ioctls SIOCMCTPALLOCTAG and
SIOCMCTPDROPTAG (DROPTAGS), there is a bug in mctp_sk_unhash function. The reason of the bug that the simultaneous DROPTAG ioctl and socket close may lead to race condition.

Reference:
https://seclists.org/oss-sec/2022/q4/36

Comment 3 Product Security DevOps Team 2022-12-04 13:03:50 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-3977