Bug 2089701 (CVE-2022-1882) - CVE-2022-1882 kernel: use-after-free in free_pipe_info() could lead to privilege escalation
Summary: CVE-2022-1882 kernel: use-after-free in free_pipe_info() could lead to privil...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2022-1882
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
: 2106777 (view as bug list)
Depends On: 2090381 2090382 2122162
Blocks: 2083438 2090105 2106783
TreeView+ depends on / blocked
 
Reported: 2022-05-24 09:32 UTC by Alex
Modified: 2023-05-12 20:07 UTC (History)
58 users (show)

Fixed In Version: Linux kernel 5.18-rc8
Doc Type: If docs needed, set a value
Doc Text:
A use-after-free flaw was found in the Linux kernel’s pipes functionality in how a user performs manipulations with the pipe post_one_notification() after free_pipe_info() that is already called. This flaw allows a local user to crash or potentially escalate their privileges on the system.
Clone Of:
Environment:
Last Closed: 2023-05-09 15:46:17 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2023:2148 0 None None None 2023-05-09 07:11:17 UTC
Red Hat Product Errata RHSA-2023:2458 0 None None None 2023-05-09 07:50:14 UTC

Description Alex 2022-05-24 09:32:31 UTC 
A UAF flaw in Linux Kernel found in pipes functionality. The problem located in function free_pipe_info of the fs/pipe.c.
When a pipe node is freed, it doesn't make pipe->watch_queue->pipe null. When function post_one_notification is called, it will use this field, but it has been freed and watch_queue->pipe is a dangling pointer.
The problem was introduced since commit db8facfc9fafacefe8a835 "watch_queue, pipe: Free watchqueue state after clearing pipe ring".

Reference:
https://git.kernel.org/linus/353f7988dd8413c4
Comment 4 Alex 2022-05-25 16:04:11 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2090381]
Comment 35 Justin M. Forbes 2022-09-20 14:35:02 UTC 
This was fixed for Fedora with the 5.18.15 stable kernel updates.
Comment 39 Rohit Keshri 2023-04-24 17:44:59 UTC 
*** Bug 2106777 has been marked as a duplicate of this bug. ***
Comment 40 errata-xmlrpc 2023-05-09 07:11:14 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:2148 https://access.redhat.com/errata/RHSA-2023:2148
Comment 41 errata-xmlrpc 2023-05-09 07:50:10 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:2458 https://access.redhat.com/errata/RHSA-2023:2458
Comment 42 Product Security DevOps Team 2023-05-09 15:46:13 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-1882
Note You need to log in before you can comment on or make changes to this bug.