In the Linux kernel, the following vulnerability has been resolved:
rtnetlink: make sure to refresh masterdev/mops in _rtnlnewlink()
While looking at one unrelated syzbot bug, I found the replay logic in _rtnlnewlink() to potentially trigger use-after-free.
It is better to clear masterdev and mops inside the loop, in case we have to replay it.
[
{
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/core/rtnetlink.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"106469260144467483732692883351041067215",
"179174686194431502192709936935857857117",
"159012079740241508342490202189227421548",
"249326808786223552748976530432018601224",
"90353182370848424804865640354074220407",
"202829569653197984919903121455822564522",
"262749342098655970407072026625989202247",
"204911911077465313747565889305825107741"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@def5e7070079b2a214b3b1a2fbec623e6fbfe34a",
"signature_type": "Line",
"id": "CVE-2022-48742-31c094ac"
},
{
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/core/rtnetlink.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"106469260144467483732692883351041067215",
"179174686194431502192709936935857857117",
"159012079740241508342490202189227421548",
"249326808786223552748976530432018601224",
"90353182370848424804865640354074220407",
"202829569653197984919903121455822564522",
"262749342098655970407072026625989202247",
"204911911077465313747565889305825107741"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@36a9a0aee881940476b254e0352581401b23f210",
"signature_type": "Line",
"id": "CVE-2022-48742-35290b5c"
},
{
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/core/rtnetlink.c",
"function": "__rtnl_newlink"
},
"digest": {
"function_hash": "131792457190229031916613196485203678245",
"length": 4926.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@36a9a0aee881940476b254e0352581401b23f210",
"signature_type": "Function",
"id": "CVE-2022-48742-6cfd0ea5"
},
{
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/core/rtnetlink.c",
"function": "__rtnl_newlink"
},
"digest": {
"function_hash": "131792457190229031916613196485203678245",
"length": 4926.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@def5e7070079b2a214b3b1a2fbec623e6fbfe34a",
"signature_type": "Function",
"id": "CVE-2022-48742-73e56b07"
},
{
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/core/rtnetlink.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"85068092726871942700503024123247959931",
"66728871571966378655713417267547298419",
"239728457929702194418840356166761505053",
"213156871416403655802336313518340628002",
"26709884036387734940668266995260660",
"213640775380997991200312090934421440471",
"328011784653207912208916015932356825075",
"151791946124872816359951909394037447673",
"175024120895933617507676885831655439165"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7d9211678c0f0624f74cdff36117ab8316697bb8",
"signature_type": "Line",
"id": "CVE-2022-48742-78952305"
},
{
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/core/rtnetlink.c",
"function": "rtnl_newlink"
},
"digest": {
"function_hash": "247806268656960323022163381962156133489",
"length": 4871.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7d9211678c0f0624f74cdff36117ab8316697bb8",
"signature_type": "Function",
"id": "CVE-2022-48742-7e6e0e7c"
},
{
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/core/rtnetlink.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"85068092726871942700503024123247959931",
"66728871571966378655713417267547298419",
"239728457929702194418840356166761505053",
"213156871416403655802336313518340628002",
"26709884036387734940668266995260660",
"213640775380997991200312090934421440471",
"328011784653207912208916015932356825075",
"151791946124872816359951909394037447673",
"175024120895933617507676885831655439165"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a01e60a1ec6bef9be471fb7182a33c6d6f124e93",
"signature_type": "Line",
"id": "CVE-2022-48742-a98a6686"
},
{
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/core/rtnetlink.c",
"function": "__rtnl_newlink"
},
"digest": {
"function_hash": "330732641882219840564699470471491441816",
"length": 4982.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bd43771ee9759dd9dfae946bff190e2c5a120de5",
"signature_type": "Function",
"id": "CVE-2022-48742-e07f02af"
},
{
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/core/rtnetlink.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"106469260144467483732692883351041067215",
"179174686194431502192709936935857857117",
"159012079740241508342490202189227421548",
"249326808786223552748976530432018601224",
"90353182370848424804865640354074220407",
"328011784653207912208916015932356825075",
"151791946124872816359951909394037447673",
"175024120895933617507676885831655439165"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bd43771ee9759dd9dfae946bff190e2c5a120de5",
"signature_type": "Line",
"id": "CVE-2022-48742-eb7bd6e0"
},
{
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/core/rtnetlink.c",
"function": "rtnl_newlink"
},
"digest": {
"function_hash": "61886881725254014127973027247553591074",
"length": 4873.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a01e60a1ec6bef9be471fb7182a33c6d6f124e93",
"signature_type": "Function",
"id": "CVE-2022-48742-f1892875"
}
]