Bug 2071022 (CVE-2022-1280) - CVE-2022-1280 kernel: concurrency use-after-free between drm_setmaster_ioctl and drm_mode_getresources
Summary: CVE-2022-1280 kernel: concurrency use-after-free between drm_setmaster_ioctl ...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2022-1280
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
: 2073427 (view as bug list)
Depends On: 2041811 2072198 2072199 2073757 2073758
Blocks: 2071023 2073430
TreeView+ depends on / blocked
 
Reported: 2022-04-01 15:10 UTC by Marian Rehak
Modified: 2023-05-12 21:19 UTC (History)
51 users (show)

Fixed In Version: Linux kernel 5.15-rc1
Doc Type: If docs needed, set a value
Doc Text:
A use-after-free vulnerability was found in drm_lease_held in drivers/gpu/drm/drm_lease.c in the Linux kernel due to a race problem. This flaw allows a local user privilege attacker to cause a denial of service (DoS) or a kernel information leak.
Clone Of:
Environment:
Last Closed: 2022-12-05 15:03:25 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2022:7933 0 None None None 2022-11-15 09:44:57 UTC
Red Hat Product Errata RHSA-2022:8267 0 None None None 2022-11-15 10:47:42 UTC

Description Marian Rehak 2022-04-01 15:10:27 UTC 
The root cause of this race is that drm_setmaster_ioctl can free an old *fpriv->master* in drm_new_set_master, while drm_mode_getresources holds a freed *fpriv->master *in drm_lease_held due to the absence of proper lock.

References:

https://www.openwall.com/lists/oss-security/2022/04/12/3
Comment 11 Pedro Sampaio 2022-04-11 12:34:20 UTC 
*** Bug 2073427 has been marked as a duplicate of this bug. ***
Comment 13 Dave Airlie 2022-04-21 07:38:49 UTC 
These are the 4 upstream patches that need to come back.

1f7ef07cfa14fb8557d1f1b7a14c76926142a4fb drm: add a locked version of drm_is_current_master
0b0860a3cf5eccf183760b1177a1dcdb821b0b66 drm: serialize drm_file.master with a new spinlock
56f0729a510f92151682ff6c89f69724d5595d6e drm: protect drm_master pointers in drm_lease.c
28be2405fb753927e18bc1a891617a430b2a0684 drm: use the lookup lock in drm_is_current_master
Comment 18 Aarthi 2022-09-02 12:12:07 UTC 
CVE-2022-1280 : Affected versions are unknown , but DRM lease infrastructure got introduced in 4.15rc1. So can we conclude that linux_kernel < 4.15rc1 are not affected?.
Comment 19 errata-xmlrpc 2022-11-15 09:44:54 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2022:7933 https://access.redhat.com/errata/RHSA-2022:7933
Comment 20 errata-xmlrpc 2022-11-15 10:47:39 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2022:8267 https://access.redhat.com/errata/RHSA-2022:8267
Comment 21 Product Security DevOps Team 2022-12-05 15:03:21 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-1280
Note You need to log in before you can comment on or make changes to this bug.