In the Linux kernel, the following vulnerability has been resolved:
net/sched: act_ct: fix ref leak when switching zones
When switching zones or network namespaces without doing a ct clear in between, it is now leaking a reference to the old ct entry. That's because tcfctskbnfctcached() returns false and tcfctflowtablelookup() may simply overwrite it.
The fix is to, as the ct entry is not reusable, free it already at tcfctskbnfctcached().
[
{
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "net/sched/act_ct.c"
},
"digest": {
"line_hashes": [
"20799790441413656051703620911920160618",
"157739101643610750178775691826143145245",
"3530463793291544721392685822064364018",
"1292214339479181220414528329589103144",
"84240592063119688782717143523906035201",
"74362190113334785377253878337873551529",
"21697907623317067591264075844254556876",
"51781456311572211467763213463561278109",
"145930040379335907693605543990126770234",
"61058572494305680063177527452227558019",
"54196257354708450637303167841977633518",
"105135349804760838859480469610730392589",
"159019182875050020809913510295622532850",
"194716048502612987387493370142556368371"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b24793a37d91aacad7cb9893b226a7924a89636a",
"signature_type": "Line",
"id": "CVE-2022-49183-19819f5e"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "net/sched/act_ct.c"
},
"digest": {
"line_hashes": [
"20799790441413656051703620911920160618",
"157739101643610750178775691826143145245",
"3530463793291544721392685822064364018",
"1292214339479181220414528329589103144",
"84240592063119688782717143523906035201",
"74362190113334785377253878337873551529",
"21697907623317067591264075844254556876",
"51781456311572211467763213463561278109",
"145930040379335907693605543990126770234",
"61058572494305680063177527452227558019",
"54196257354708450637303167841977633518",
"105135349804760838859480469610730392589",
"159019182875050020809913510295622532850",
"194716048502612987387493370142556368371"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bcbf4e5c3b5b373cd61528392dd1ec8e9c0fd33d",
"signature_type": "Line",
"id": "CVE-2022-49183-2a600720"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "tcf_ct_skb_nfct_cached",
"file": "net/sched/act_ct.c"
},
"digest": {
"function_hash": "270387323531312022201574898255221149588",
"length": 500.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4bb42d73def9411e5cad885b9811987d72431df1",
"signature_type": "Function",
"id": "CVE-2022-49183-3b24eca3"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "tcf_ct_skb_nfct_cached",
"file": "net/sched/act_ct.c"
},
"digest": {
"function_hash": "270387323531312022201574898255221149588",
"length": 500.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bcb74e132a76ce0502bb33d5b65533a4ed72d159",
"signature_type": "Function",
"id": "CVE-2022-49183-3c35471d"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "net/sched/act_ct.c"
},
"digest": {
"line_hashes": [
"20799790441413656051703620911920160618",
"157739101643610750178775691826143145245",
"3530463793291544721392685822064364018",
"1292214339479181220414528329589103144",
"84240592063119688782717143523906035201",
"74362190113334785377253878337873551529",
"21697907623317067591264075844254556876",
"51781456311572211467763213463561278109",
"145930040379335907693605543990126770234",
"61058572494305680063177527452227558019",
"54196257354708450637303167841977633518",
"105135349804760838859480469610730392589",
"159019182875050020809913510295622532850",
"194716048502612987387493370142556368371"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bcb74e132a76ce0502bb33d5b65533a4ed72d159",
"signature_type": "Line",
"id": "CVE-2022-49183-5a626308"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "tcf_ct_skb_nfct_cached",
"file": "net/sched/act_ct.c"
},
"digest": {
"function_hash": "270387323531312022201574898255221149588",
"length": 500.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bcbf4e5c3b5b373cd61528392dd1ec8e9c0fd33d",
"signature_type": "Function",
"id": "CVE-2022-49183-ac8a8afc"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "tcf_ct_skb_nfct_cached",
"file": "net/sched/act_ct.c"
},
"digest": {
"function_hash": "270387323531312022201574898255221149588",
"length": 500.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b24793a37d91aacad7cb9893b226a7924a89636a",
"signature_type": "Function",
"id": "CVE-2022-49183-ecd91d7e"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "net/sched/act_ct.c"
},
"digest": {
"line_hashes": [
"20799790441413656051703620911920160618",
"157739101643610750178775691826143145245",
"3530463793291544721392685822064364018",
"1292214339479181220414528329589103144",
"84240592063119688782717143523906035201",
"74362190113334785377253878337873551529",
"21697907623317067591264075844254556876",
"51781456311572211467763213463561278109",
"145930040379335907693605543990126770234",
"61058572494305680063177527452227558019",
"54196257354708450637303167841977633518",
"105135349804760838859480469610730392589",
"159019182875050020809913510295622532850",
"194716048502612987387493370142556368371"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4bb42d73def9411e5cad885b9811987d72431df1",
"signature_type": "Line",
"id": "CVE-2022-49183-f26f36b1"
}
]