Bug 2088021 (CVE-2022-29581) - CVE-2022-29581 kernel: use-after-free due to improper update of reference count in net/sched/cls_u32.c
Summary: CVE-2022-29581 kernel: use-after-free due to improper update of reference cou...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2022-29581
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2080193 2081283 2088023 2089109 2089110 2089111 2089112 2090410
Blocks: 2088024
TreeView+ depends on / blocked
 
Reported: 2022-05-18 16:50 UTC by Guilherme de Almeida Suckevicz
Modified: 2024-03-12 16:25 UTC (History)
52 users (show)

Fixed In Version: kernel 5.18 rc4
Doc Type: If docs needed, set a value
Doc Text:
A use-after-free flaw was found in u32_change in net/sched/cls_u32.c in the network subcomponent of the Linux kernel. This flaw allows a local attacker to crash the system, cause a privilege escalation, and leak kernel information.
Clone Of:
Environment:
Last Closed: 2022-12-05 08:36:23 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2022:7444 0 None None None 2022-11-08 09:10:16 UTC
Red Hat Product Errata RHSA-2022:7683 0 None None None 2022-11-08 10:09:53 UTC
Red Hat Product Errata RHSA-2022:7933 0 None None None 2022-11-15 09:45:13 UTC
Red Hat Product Errata RHSA-2022:8267 0 None None None 2022-11-15 10:48:07 UTC
Red Hat Product Errata RHSA-2024:0930 0 None None None 2024-02-21 00:26:40 UTC

Description Guilherme de Almeida Suckevicz 2022-05-18 16:50:07 UTC 
A use-after-free flaw was found in u32_change in net/sched/cls_u32.c in the network subcomponent of the Linux kernel.  This flaw could allow a local attacker to crash the system and cause a privilege escalation, and a kernel information leak problem.

References and upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3db09e762dc79584a69c10d74a6b98f89a9979f8
https://kernel.dance/#3db09e762dc79584a69c10d74a6b98f89a9979f8
Comment 1 Guilherme de Almeida Suckevicz 2022-05-18 16:51:44 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2088023]
Comment 2 Justin M. Forbes 2022-05-18 18:53:29 UTC 
This was fixed for fedora with the 5.17.5 stable kernel update.
Comment 12 errata-xmlrpc 2022-11-08 09:10:12 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:7444 https://access.redhat.com/errata/RHSA-2022:7444
Comment 13 errata-xmlrpc 2022-11-08 10:09:49 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:7683 https://access.redhat.com/errata/RHSA-2022:7683
Comment 14 errata-xmlrpc 2022-11-15 09:45:08 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2022:7933 https://access.redhat.com/errata/RHSA-2022:7933
Comment 15 errata-xmlrpc 2022-11-15 10:48:03 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2022:8267 https://access.redhat.com/errata/RHSA-2022:8267
Comment 16 Product Security DevOps Team 2022-12-05 08:36:19 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-29581
Comment 27 errata-xmlrpc 2024-02-21 00:26:36 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2024:0930 https://access.redhat.com/errata/RHSA-2024:0930
Note You need to log in before you can comment on or make changes to this bug.