Bug 2103681 (CVE-2022-2959) - CVE-2022-2959 kernel: watch queue race condition can lead to privilege escalation
Summary: CVE-2022-2959 kernel: watch queue race condition can lead to privilege escala...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2022-2959
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2115232 2115233 2141630 2141631 2141632 2141633 2141634 2141635 2141636 2141637
Blocks: 2103682
TreeView+ depends on / blocked
 
Reported: 2022-07-04 13:43 UTC by Mauro Matteo Cascella
Modified: 2023-09-28 04:25 UTC (History)
60 users (show)

Fixed In Version: kernel 5.19
Doc Type: If docs needed, set a value
Doc Text:
A race condition was found in the Linux kernel's watch queue due to a missing lock in the pipe_resize_ring(). The race condition occurs when a thread uses ioctl(IOC_WATCH_QUEUE_SET_SIZE) to resize the pipe buffer and free the old pipe buffer, while another thread uses keyctl() to trigger a notification in the watch queue, calling post_one_notification() and accessing the freed pipe buffer. This flaw allows a local user to crash the system or escalate their privileges on the system.
Clone Of:
Environment:
Last Closed: 2023-01-25 08:22:16 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2022:9021 0 None None None 2022-12-14 12:03:02 UTC
Red Hat Product Errata RHSA-2022:8973 0 None None None 2022-12-13 16:05:53 UTC
Red Hat Product Errata RHSA-2022:8974 0 None None None 2022-12-13 16:06:33 UTC
Red Hat Product Errata RHSA-2022:9082 0 None None None 2022-12-15 16:24:35 UTC
Red Hat Product Errata RHSA-2023:0300 0 None None None 2023-01-23 15:17:00 UTC
Red Hat Product Errata RHSA-2023:0334 0 None None None 2023-01-23 15:21:33 UTC
Red Hat Product Errata RHSA-2023:0348 0 None None None 2023-01-23 15:23:10 UTC

Description Mauro Matteo Cascella 2022-07-04 13:43:36 UTC 
A race condition was found in the Linux kernel's watch queue due to a missing lock in pipe_resize_ring(). The race condition may happen when thread (A) uses ioctl(IOC_WATCH_QUEUE_SET_SIZE) to resize the pipe buffer and free the old pipe buffer, while another thread (B) uses keyctl() to trigger a notification in the watch queue, calling post_one_notification() and accessing the freed pipe buffer.

ZDI advisory:
https://www.zerodayinitiative.com/advisories/ZDI-22-1165/

Upstream fix:
https://github.com/torvalds/linux/commit/189b0ddc245139af81198d1a3637cac74f96e13a
Comment 9 errata-xmlrpc 2022-12-13 16:05:50 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2022:8973 https://access.redhat.com/errata/RHSA-2022:8973
Comment 10 errata-xmlrpc 2022-12-13 16:06:28 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2022:8974 https://access.redhat.com/errata/RHSA-2022:8974
Comment 11 errata-xmlrpc 2022-12-15 16:24:30 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2022:9082 https://access.redhat.com/errata/RHSA-2022:9082
Comment 13 errata-xmlrpc 2023-01-23 15:16:55 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:0300 https://access.redhat.com/errata/RHSA-2023:0300
Comment 14 errata-xmlrpc 2023-01-23 15:21:27 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:0334 https://access.redhat.com/errata/RHSA-2023:0334
Comment 15 errata-xmlrpc 2023-01-23 15:23:05 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:0348 https://access.redhat.com/errata/RHSA-2023:0348
Comment 16 Product Security DevOps Team 2023-01-25 08:22:11 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-2959
Comment 17 Red Hat Bugzilla 2023-09-28 04:25:13 UTC 
The needinfo request[s] on this closed bug have been removed as they have been unresolved for 120 days
Note You need to log in before you can comment on or make changes to this bug.