Bug 2152548 (CVE-2022-4378) - CVE-2022-4378 kernel: stack overflow in do_proc_dointvec and proc_skip_spaces
Summary: CVE-2022-4378 kernel: stack overflow in do_proc_dointvec and proc_skip_spaces
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2022-4378
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2152564 2152565 2152566 2152567 2152568 2152569 2152570 2152571 2152572 2152573 2152574 2152575 2152576 2152577 2152578 2152579 2152580 2152581 2152582 2152583 2152584 2152589 2152590 2152591 2152592 2152593 2152594 2152595 2152596 2152597 2152598 2152599 2152603 2152604 2152605 2152606 2152607 2160015
Blocks: 2151836
TreeView+ depends on / blocked
 
Reported: 2022-12-12 10:12 UTC by Alex
Modified: 2023-06-07 01:31 UTC (History)
47 users (show)

Fixed In Version: kernel 6.0.12
Doc Type: If docs needed, set a value
Doc Text:
A stack overflow flaw was found in the Linux kernel's SYSCTL subsystem in how a user changes certain kernel parameters and variables. This flaw allows a local user to crash or potentially escalate their privileges on the system.
Clone Of:
Environment:
Last Closed: 2023-06-07 01:31:57 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2023:1050 0 None None None 2023-03-02 05:37:47 UTC
Red Hat Product Errata RHSA-2023:0856 0 None None None 2023-02-21 10:03:02 UTC
Red Hat Product Errata RHSA-2023:0858 0 None None None 2023-02-21 10:03:39 UTC
Red Hat Product Errata RHSA-2023:0944 0 None None None 2023-02-28 08:03:40 UTC
Red Hat Product Errata RHSA-2023:0945 0 None None None 2023-02-28 08:04:01 UTC
Red Hat Product Errata RHSA-2023:0951 0 None None None 2023-02-28 08:18:43 UTC
Red Hat Product Errata RHSA-2023:0979 0 None None None 2023-02-28 09:51:13 UTC
Red Hat Product Errata RHSA-2023:1008 0 None None None 2023-02-28 11:42:44 UTC
Red Hat Product Errata RHSA-2023:1091 0 None None None 2023-03-07 09:54:04 UTC
Red Hat Product Errata RHSA-2023:1092 0 None None None 2023-03-07 09:54:14 UTC
Red Hat Product Errata RHSA-2023:1101 0 None None None 2023-03-07 09:52:59 UTC
Red Hat Product Errata RHSA-2023:1103 0 None None None 2023-03-07 09:49:16 UTC
Red Hat Product Errata RHSA-2023:1109 0 None None None 2023-03-07 13:16:55 UTC
Red Hat Product Errata RHSA-2023:1110 0 None None None 2023-03-07 13:14:26 UTC
Red Hat Product Errata RHSA-2023:1202 0 None None None 2023-03-14 13:53:49 UTC
Red Hat Product Errata RHSA-2023:1203 0 None None None 2023-03-14 13:54:08 UTC
Red Hat Product Errata RHSA-2023:1220 0 None None None 2023-03-14 13:58:18 UTC
Red Hat Product Errata RHSA-2023:1221 0 None None None 2023-03-14 13:58:50 UTC
Red Hat Product Errata RHSA-2023:1251 0 None None None 2023-03-15 09:49:28 UTC
Red Hat Product Errata RHSA-2023:1435 0 None None None 2023-03-23 09:03:37 UTC
Red Hat Product Errata RHSA-2023:1566 0 None None None 2023-04-04 09:21:35 UTC
Red Hat Product Errata RHSA-2023:1584 0 None None None 2023-04-04 09:05:17 UTC
Red Hat Product Errata RHSA-2023:1659 0 None None None 2023-04-05 14:05:50 UTC
Red Hat Product Errata RHSA-2023:1705 0 None None None 2023-04-11 14:10:16 UTC
Red Hat Product Errata RHSA-2023:1706 0 None None None 2023-04-11 14:20:18 UTC
Red Hat Product Errata RHSA-2023:1822 0 None None None 2023-04-18 13:54:48 UTC
Red Hat Product Errata RHSA-2023:3388 0 None None None 2023-05-31 15:50:51 UTC
Red Hat Product Errata RHSA-2023:3431 0 None None None 2023-06-05 08:14:30 UTC
Red Hat Product Errata RHSA-2023:3491 0 None None None 2023-06-06 14:11:52 UTC

Description Alex 2022-12-12 10:12:48 UTC 
A flaw stack overflow in the Linux Kernel found. If user have access to SYSCTL (dynamically changing certain kernel parameters and variables), then can provide incorrect input to the function do_proc_dointvec leading to system crash or potentially privileges escalation. Known example of such incorrect input by local user for the /proc/sys/net/ipv4/tcp_rmem , but it could be other situations when this function being used.

References:
https://seclists.org/oss-sec/2022/q4/178
https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.0/proc-proc_skip_spaces-shouldn-t-think-it-is-working-on-c-strings.patch
https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.0/proc-avoid-integer-type-confusion-in-get_proc_long.patch
Comment 6 Marian Rehak 2022-12-12 12:38:18 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2152607]
Comment 7 Justin M. Forbes 2022-12-14 15:44:07 UTC 
This was fixed for Fedora with the 6.0.12 stable kernel updates.
Comment 11 errata-xmlrpc 2023-02-21 10:02:59 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions

Via RHSA-2023:0856 https://access.redhat.com/errata/RHSA-2023:0856
Comment 12 errata-xmlrpc 2023-02-21 10:03:36 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions

Via RHSA-2023:0858 https://access.redhat.com/errata/RHSA-2023:0858
Comment 13 errata-xmlrpc 2023-02-28 08:03:37 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.7 Advanced Update Support
  Red Hat Enterprise Linux 7.7 Update Services for SAP Solutions
  Red Hat Enterprise Linux 7.7 Telco Extended Update Support

Via RHSA-2023:0944 https://access.redhat.com/errata/RHSA-2023:0944
Comment 14 errata-xmlrpc 2023-02-28 08:03:57 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.7 Update Services for SAP Solutions

Via RHSA-2023:0945 https://access.redhat.com/errata/RHSA-2023:0945
Comment 15 errata-xmlrpc 2023-02-28 08:18:39 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:0951 https://access.redhat.com/errata/RHSA-2023:0951
Comment 16 errata-xmlrpc 2023-02-28 09:51:09 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:0979 https://access.redhat.com/errata/RHSA-2023:0979
Comment 17 errata-xmlrpc 2023-02-28 11:42:39 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:1008 https://access.redhat.com/errata/RHSA-2023:1008
Comment 18 errata-xmlrpc 2023-03-07 09:49:13 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions

Via RHSA-2023:1103 https://access.redhat.com/errata/RHSA-2023:1103
Comment 19 errata-xmlrpc 2023-03-07 09:52:55 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2023:1101 https://access.redhat.com/errata/RHSA-2023:1101
Comment 20 errata-xmlrpc 2023-03-07 09:54:00 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2023:1091 https://access.redhat.com/errata/RHSA-2023:1091
Comment 21 errata-xmlrpc 2023-03-07 09:54:10 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2023:1092 https://access.redhat.com/errata/RHSA-2023:1092
Comment 22 errata-xmlrpc 2023-03-07 13:14:23 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Telecommunications Update Service

Via RHSA-2023:1110 https://access.redhat.com/errata/RHSA-2023:1110
Comment 23 errata-xmlrpc 2023-03-07 13:16:51 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Advanced Update Support
  Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.2 Telecommunications Update Service

Via RHSA-2023:1109 https://access.redhat.com/errata/RHSA-2023:1109
Comment 24 errata-xmlrpc 2023-03-14 13:53:46 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2023:1202 https://access.redhat.com/errata/RHSA-2023:1202
Comment 25 errata-xmlrpc 2023-03-14 13:54:03 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2023:1203 https://access.redhat.com/errata/RHSA-2023:1203
Comment 26 errata-xmlrpc 2023-03-14 13:58:13 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Extended Update Support

Via RHSA-2023:1220 https://access.redhat.com/errata/RHSA-2023:1220
Comment 27 errata-xmlrpc 2023-03-14 13:58:46 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Extended Update Support

Via RHSA-2023:1221 https://access.redhat.com/errata/RHSA-2023:1221
Comment 28 errata-xmlrpc 2023-03-15 09:49:25 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Extended Update Support

Via RHSA-2023:1251 https://access.redhat.com/errata/RHSA-2023:1251
Comment 29 errata-xmlrpc 2023-03-23 09:03:33 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2023:1435 https://access.redhat.com/errata/RHSA-2023:1435
Comment 32 errata-xmlrpc 2023-04-04 09:05:12 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:1584 https://access.redhat.com/errata/RHSA-2023:1584
Comment 33 errata-xmlrpc 2023-04-04 09:21:32 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:1566 https://access.redhat.com/errata/RHSA-2023:1566
Comment 34 errata-xmlrpc 2023-04-05 14:05:46 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:1659 https://access.redhat.com/errata/RHSA-2023:1659
Comment 35 errata-xmlrpc 2023-04-11 14:10:12 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.6 Advanced Update Support

Via RHSA-2023:1705 https://access.redhat.com/errata/RHSA-2023:1705
Comment 36 errata-xmlrpc 2023-04-11 14:20:15 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.4 Advanced Update Support

Via RHSA-2023:1706 https://access.redhat.com/errata/RHSA-2023:1706
Comment 37 errata-xmlrpc 2023-04-18 13:54:44 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6 Extended Lifecycle Support

Via RHSA-2023:1822 https://access.redhat.com/errata/RHSA-2023:1822
Comment 39 errata-xmlrpc 2023-05-31 15:50:46 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2023:3388 https://access.redhat.com/errata/RHSA-2023:3388
Comment 40 errata-xmlrpc 2023-06-05 08:14:27 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2023:3431 https://access.redhat.com/errata/RHSA-2023:3431
Comment 41 errata-xmlrpc 2023-06-06 14:11:48 UTC 
This issue has been addressed in the following products:

  Red Hat Virtualization 4 for Red Hat Enterprise Linux 8

Via RHSA-2023:3491 https://access.redhat.com/errata/RHSA-2023:3491
Comment 43 Product Security DevOps Team 2023-06-07 01:31:52 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-4378
Note You need to log in before you can comment on or make changes to this bug.