Bug 2155946 (CVE-2022-47942, ZDI-22-1688, ZDI-CAN-17771)

Summary:	CVE-2022-47942 kernel: improper validation user-supplied data could lead in heap buffer overflow which can result in RCE
Product:	[Other] Security Response	Reporter:	Michael Kaplan <mkaplan>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	acaringi, bdettelb, bhu, chwhite, crwood, ddepaula, debarbos, dfreiber, dhoward, dvlasenk, ezulian, fhrbata, hkrzesin, jarod, jburrell, jfaracco, jferlan, jforbes, jlelli, joe.lawrence, jshortt, jstancek, jwyatt, kcarcia, kernel-mgr, lgoncalv, lleshchi, lzampier, nmurray, ptalbert, qzhao, rogbas, rvrbovsk, scweaver, tyberry, vkumar, walters, williams
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	kernel 6.0-rc1	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-12-24 15:39:47 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2155952
Bug Blocks:	2155936

Description Michael Kaplan 2022-12-23 01:55:21 UTC

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Kernel. Authentication is required to exploit this vulnerability.

The specific flaw exists within the handling of file attributes. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the kernel.

References: 

https://www.zerodayinitiative.com/advisories/ZDI-22-1688/

Comment 1 Michael Kaplan 2022-12-23 02:02:26 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2155952]

Comment 4 Sandipan Roy 2022-12-23 07:15:50 UTC

There was no shipped kernel version that was seen affected by this problem. These files are not built in our source code.

Comment 5 Product Security DevOps Team 2022-12-24 15:39:42 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-47942