Bug 2088021 (CVE-2022-29581) - CVE-2022-29581 kernel: use-after-free due to improper update of reference count in net/sched/cls_u32.c [NEEDINFO]
Summary: CVE-2022-29581 kernel: use-after-free due to improper update of reference cou...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2022-29581
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2080193 2081283 2088023 2089109 2089110 2089111 2089112 2090410
Blocks: 2088024
TreeView+ depends on / blocked
 
Reported: 2022-05-18 16:50 UTC by Guilherme de Almeida Suckevicz
Modified: 2023-08-21 16:16 UTC (History)
51 users (show)

Fixed In Version: kernel 5.18 rc4
Doc Type: If docs needed, set a value
Doc Text:
A use-after-free flaw was found in u32_change in net/sched/cls_u32.c in the network subcomponent of the Linux kernel. This flaw allows a local attacker to crash the system, cause a privilege escalation, and leak kernel information.
Clone Of:
Environment:
Last Closed: 2022-12-05 08:36:23 UTC
Embargoed:
gsuckevi: needinfo? (rkeshri)

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2022:7444 0 None None None 2022-11-08 09:10:16 UTC
Red Hat Product Errata RHSA-2022:7683 0 None None None 2022-11-08 10:09:53 UTC
Red Hat Product Errata RHSA-2022:7933 0 None None None 2022-11-15 09:45:13 UTC
Red Hat Product Errata RHSA-2022:8267 0 None None None 2022-11-15 10:48:07 UTC

Description Guilherme de Almeida Suckevicz 2022-05-18 16:50:07 UTC 
A use-after-free flaw was found in u32_change in net/sched/cls_u32.c in the network subcomponent of the Linux kernel.  This flaw could allow a local attacker to crash the system and cause a privilege escalation, and a kernel information leak problem.

References and upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3db09e762dc79584a69c10d74a6b98f89a9979f8
https://kernel.dance/#3db09e762dc79584a69c10d74a6b98f89a9979f8
Comment 1 Guilherme de Almeida Suckevicz 2022-05-18 16:51:44 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2088023]
Comment 2 Justin M. Forbes 2022-05-18 18:53:29 UTC 
This was fixed for fedora with the 5.17.5 stable kernel update.
Comment 12 errata-xmlrpc 2022-11-08 09:10:12 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:7444 https://access.redhat.com/errata/RHSA-2022:7444
Comment 13 errata-xmlrpc 2022-11-08 10:09:49 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:7683 https://access.redhat.com/errata/RHSA-2022:7683
Comment 14 errata-xmlrpc 2022-11-15 09:45:08 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2022:7933 https://access.redhat.com/errata/RHSA-2022:7933
Comment 15 errata-xmlrpc 2022-11-15 10:48:03 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2022:8267 https://access.redhat.com/errata/RHSA-2022:8267
Comment 16 Product Security DevOps Team 2022-12-05 08:36:19 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-29581
Comment 17 Jan Pazdziora 2023-07-29 11:49:07 UTC 
Hello,

the CVE page https://access.redhat.com/security/cve/CVE-2022-29581 says in the Mitigation section

  To mitigate this issue, prevent the module u32 from being loaded by blacklisting the module to prevent it from loading automatically.

However, at least on RHEL 9.0 and 8.6, module u32 does not exist. Instead, is it possible that cls_u32 should be mentioned in that text?

Thank you, Jan
Comment 18 Jan Pazdziora 2023-08-21 15:10:31 UTC 
Hello Guilherme,

could you please help answer the question in comment 17?

Thank you, Jan
Comment 19 Guilherme de Almeida Suckevicz 2023-08-21 16:16:40 UTC 
Hi,

Redirecting the needinfo to Rohit, the Product Security analyst who handled this CVE.

@Rohit, could you please check?

Thanks.
Note You need to log in before you can comment on or make changes to this bug.