CVE-2022-49667
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2022-49667
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-49667.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2022-49667
- Related
- Published
- 2025-02-26T07:01:41Z
- Modified
- 2025-03-24T20:54:07.625564Z
- Downstream
- Summary
- [none]
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
net: bonding: fix use-after-free after 802.3ad slave unbind
commit 0622cab0341c ("bonding: fix 802.3ad aggregator reselection"), resolve case, when there is several aggregation groups in the same bond. bond3adunbindslave will invalidate (clear) aggregator when _aggactiveports return zero. So, adclearagg can be executed even, when numofports!=0. Than bond3adunbindslave can be executed again for, previously cleared aggregator. NOTE: at this time bond3adunbindslave will not update slave ports list, because lag_ports==NULL. So, here we got slave ports, pointing to freed aggregator memory.
Fix with checking actual number of ports in group (as was before commit 0622cab0341c ("bonding: fix 802.3ad aggregator reselection") ), before adclearagg().
The KASAN logs are as follows:
[ 767.617392] ================================================================== [ 767.630776] BUG: KASAN: use-after-free in bond3adstatemachinehandler+0x13dc/0x1470 [ 767.638764] Read of size 2 at addr ffff00011ba9d430 by task kworker/u8:7/767 [ 767.647361] CPU: 3 PID: 767 Comm: kworker/u8:7 Tainted: G O 5.15.11 #15 [ 767.655329] Hardware name: DNI AmazonGo1 A7040 board (DT) [ 767.660760] Workqueue: lacp1 bond3adstatemachinehandler [ 767.666468] Call trace: [ 767.668930] dumpbacktrace+0x0/0x2d0 [ 767.672625] showstack+0x24/0x30 [ 767.675965] dumpstacklvl+0x68/0x84 [ 767.679659] printaddressdescription.constprop.0+0x74/0x2b8 [ 767.685451] kasanreport+0x1f0/0x260 [ 767.689148] _asanload2+0x94/0xd0 [ 767.692667] bond3adstatemachinehandler+0x13dc/0x1470
- References
-
- https://git.kernel.org/stable/c/050133e1aa2cb49bb17be847d48a4431598ef562
- https://git.kernel.org/stable/c/2765749def4765c5052a4c66445cf4c96fcccdbc
- https://git.kernel.org/stable/c/63b2fe509f69b90168a75e04e14573dccf7984e6
- https://git.kernel.org/stable/c/893825289ba840afd86bfffcb6f7f363c73efff8
- https://git.kernel.org/stable/c/a853b7a3a9fd1d74a4ccdd9cd73512b7dace2f1e
- https://git.kernel.org/stable/c/b90ac60303063a43e17dd4aec159067599d255e6
- https://git.kernel.org/stable/c/ef0af7d08d26c5333ff4944a559279464edf6f15
- https://git.kernel.org/stable/c/f162f7c348fa2a5555bafdb5cc890b89b221e69c
- https://security-tracker.debian.org/tracker/CVE-2022-49667
Affected packages
Debian:11 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed5.10.136-1
Debian:12 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source
Debian:13 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source