Bug 2155943 (CVE-2022-47939, ZDI-22-1690, ZDI-CAN-17816)

Summary:	CVE-2022-47939 kernel: smb2_tree_disconnect() fails to validate object existance prior to performing opertions on it
Product:	[Other] Security Response	Reporter:	Michael Kaplan <mkaplan>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	urgent	Docs Contact:
Priority:	urgent
Version:	unspecified	CC:	acaringi, bdettelb, bhu, chwhite, crwood, ddepaula, debarbos, dfreiber, dhoward, dvlasenk, ezulian, fhrbata, hkrzesin, jarod, jburrell, jfaracco, jferlan, jforbes, jlelli, joe.lawrence, jshortt, jstancek, jwyatt, kcarcia, kernel-mgr, lgoncalv, lleshchi, lzampier, nmurray, ptalbert, qzhao, rogbas, rvrbovsk, saroy, scweaver, tyberry, vkumar, walters, williams
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	kernel 6.0-rc1	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-12-24 14:08:04 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2155948
Bug Blocks:	2155936

Description Michael Kaplan 2022-12-23 01:16:14 UTC

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Kernel. Authentication is not required to exploit this vulnerability, but only systems with ksmbd enabled are vulnerable.

The specific flaw exists within the processing of SMB2_TREE_DISCONNECT commands. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the kernel.

Comment 1 Michael Kaplan 2022-12-23 01:18:37 UTC

References: 

https://www.zerodayinitiative.com/advisories/ZDI-22-1690/

Comment 2 Michael Kaplan 2022-12-23 02:02:06 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2155948]

Comment 5 Sandipan Roy 2022-12-23 05:07:08 UTC

There was no shipped kernel version that was seen affected by this problem. These files are not built in our source code.

Comment 8 Product Security DevOps Team 2022-12-24 14:08:00 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-47939