Bug 2056381 (CVE-2022-1195) - CVE-2022-1195 kernel: A possible race condition (use-after-free) in drivers/net/hamradio/6pack ( mkiss.c) after unregister_netdev
Summary: CVE-2022-1195 kernel: A possible race condition (use-after-free) in drivers/n...
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2022-1195
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
: 2056382 2141676 (view as bug list)
Depends On: 2070572 2070573
Blocks: 2056384 2070627 2141373
TreeView+ depends on / blocked
 
Reported: 2022-02-21 06:18 UTC by TEJ RATHI
Modified: 2023-05-10 12:38 UTC (History)
49 users (show)

Fixed In Version: kernel 5.16 rc1
Doc Type: If docs needed, set a value
Doc Text:
A use-after-free vulnerability was found in the Linux kernel in drivers/net/hamradio. This flaw allows a local attacker with a user privilege to cause a denial of service (DOS) when the mkiss or sixpack device is detached and reclaim resources early.
Clone Of:
Environment:
Last Closed: 2022-08-25 10:33:38 UTC
Embargoed:

Attachments (Terms of Use)

Description TEJ RATHI 2022-02-21 06:18:32 UTC 
A use-after-free vulnerability was found in drivers/net/hamradio in the Linux kernel. In this flaw, a local attacker with a user privilege may lead to a denial of service (DOS) problem, when mkiss or sixpack device is detached, and reclaim resources early.

Reference:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b2f37aead1b82a770c48b5d583f35ec22aabb61e
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=81b1d548d00bcd028303c4f3150fa753b9b8aa71
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0b9111922b1f399aba6ed1e1b8f2079c3da1aed8
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3e0588c291d6ce225f2b891753ca41d45ba42469


==================================================================
[   26.882075] BUG: KASAN: use-after-free in
tty_insert_flip_string_fixed_flag+0xd8/0x1e0
[   26.882075] Read of size 85 at addr ffff88800690d000 by task trigger/141
[   26.882075]
[   26.882075] CPU: 3 PID: 141 Comm: trigger Not tainted 5.11.0 #6
[   26.882075] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
[   26.882075] Call Trace:
[   26.882075]  dump_stack+0x7d/0xa3
[   26.882075]  print_address_description.constprop.0+0x18/0x130
[   26.882075]  ? tty_insert_flip_string_fixed_flag+0xd8/0x1e0
[   26.882075]  ? tty_insert_flip_string_fixed_flag+0xd8/0x1e0
[   26.882075]  kasan_report.cold+0x7f/0x10e
[   26.882075]  ? tty_insert_flip_string_fixed_flag+0xd8/0x1e0
[   26.882075]  check_memory_region+0xf9/0x1e0
[   26.882075]  memcpy+0x20/0x60
[   26.882075]  tty_insert_flip_string_fixed_flag+0xd8/0x1e0
[   26.882075]  pty_write+0xfa/0x1b0
[   26.882075]  ? pty_set_termios+0x5d0/0x5d0
[   26.882075]  ax_encaps+0x9c9/0xb60
[   26.882075]  ax_xmit+0x36a/0x37e
[   26.882075]  dev_hard_start_xmit+0x160/0x500
[   26.882075]  sch_direct_xmit+0x20b/0xa00
[   26.882075]  ? qdisc_put_unlocked+0x50/0x50
[   26.882075]  ? sysvec_apic_timer_interrupt+0x33/0xd0
[   26.882075]  ? pfifo_fast_dequeue+0x275/0xa30
[   26.882075]  __qdisc_run+0x3a0/0x1390
[   26.882075]  __dev_queue_xmit+0xabb/0x1b10
[   26.882075]  ? netdev_core_pick_tx+0x2a0/0x2a0
[   26.882075]  ? sysvec_apic_timer_interrupt+0x33/0xd0
[   26.882075]  ? memcpy+0x39/0x60
[   26.882075]  ? ax25_addr_build+0x7e/0x2a0
[   26.882075]  ax25_sendmsg+0xb70/0x1090
[   26.882075]  ? selinux_inode_notifysecctx+0x20/0x20
[   26.882075]  ? ax25_device_event+0x210/0x210
[   26.882075]  ? __fget_files+0x15b/0x210
[   26.882075]  ? ax25_device_event+0x210/0x210
[   26.882075]  sock_sendmsg+0xdf/0x110
[   26.882075]  __sys_sendto+0x19e/0x270
[   26.882075]  ? __ia32_sys_getpeername+0xa0/0xa0
[   26.882075]  ? copy_init_fpstate_to_fpregs+0x70/0x70
[   26.882075]  __x64_sys_sendto+0xd8/0x1b0
[   26.882075]  ? exit_to_user_mode_prepare+0x2c/0x120
[   26.882075]  do_syscall_64+0x33/0x40
[   26.882075]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
<..>
==================================================================
Comment 1 Rohit Keshri 2022-03-31 12:12:14 UTC 
*** Bug 2056382 has been marked as a duplicate of this bug. ***
Comment 7 Rohit Keshri 2022-03-31 13:31:53 UTC 
There was no shipped kernel version that was seen affected by this problem. These files are not built in our source code.
Comment 11 Alex 2022-11-10 14:04:34 UTC 
*** Bug 2141676 has been marked as a duplicate of this bug. ***
Note You need to log in before you can comment on or make changes to this bug.