In the Linux kernel, the following vulnerability has been resolved:
macsec: fix UAF bug for real_dev
Create a new macsec device but not get reference to realdev. That can not ensure that realdev is freed after macsec. That will trigger the UAF bug for real_dev as following:
================================================================== BUG: KASAN: use-after-free in macsecgetiflink+0x5f/0x70 drivers/net/macsec.c:3662 Call Trace: ... macsecgetiflink+0x5f/0x70 drivers/net/macsec.c:3662 devgetiflink+0x73/0xe0 net/core/dev.c:637 defaultoperstate net/core/linkwatch.c:42 [inline] rfc2863policy+0x233/0x2d0 net/core/linkwatch.c:54 linkwatchdodev+0x2a/0x150 net/core/link_watch.c:161
Allocated by task 22209: ... allocnetdevmqs+0x98/0x1100 net/core/dev.c:10549 rtnlcreatelink+0x9d7/0xc00 net/core/rtnetlink.c:3235 veth_newlink+0x20e/0xa90 drivers/net/veth.c:1748
Freed by task 8: ... kfree+0xd6/0x4d0 mm/slub.c:4552 kvfree+0x42/0x50 mm/util.c:615 devicerelease+0x9f/0x240 drivers/base/core.c:2229 kobjectcleanup lib/kobject.c:673 [inline] kobjectrelease lib/kobject.c:704 [inline] krefput include/linux/kref.h:65 [inline] kobjectput+0x1c8/0x540 lib/kobject.c:721 netdevrun_todo+0x72e/0x10b0 net/core/dev.c:10327
After commit faab39f63c1f ("net: allow out-of-order netdev unregistration") and commit e5f80fcf869a ("ipv6: give an IPv6 dev to blackholenetdev"), we can add devholdtrack() in macsecdevinit() and devputtrack() in macsecfree_netdev() to fix the problem.
[ { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@78933cbc143b82d02330e00900d2fd08f2682f4e", "signature_version": "v1", "target": { "file": "drivers/net/macsec.c", "function": "macsec_dev_init" }, "digest": { "length": 875.0, "function_hash": "25872192223660054141787646737134360713" }, "deprecated": false, "signature_type": "Function", "id": "CVE-2022-49390-099b832b" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@78933cbc143b82d02330e00900d2fd08f2682f4e", "signature_version": "v1", "target": { "file": "drivers/net/macsec.c", "function": "macsec_free_netdev" }, "digest": { "length": 149.0, "function_hash": "133298807134360131036355873865255580214" }, "deprecated": false, "signature_type": "Function", "id": "CVE-2022-49390-2872bded" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@196a888ca6571deb344468e1d7138e3273206335", "signature_version": "v1", "target": { "file": "drivers/net/macsec.c" }, "digest": { "line_hashes": [ "94838268209777072685933967372110725461", "108300532954511183856245307250976855960", "107485027214517644763938070234913637817", "322256779107262978926529581078177029203", "233897599446611416132264001831098838813", "100760215041285354904804334363595525713", "170690726430864746021570246615604158995", "328676940738296094076318639409859839157", "221483060195464846380024910175412184951", "17464071169014596474933706965992032134", "8279904749182720410446308718304623312", "35341229327224431492700492042555578046" ], "threshold": 0.9 }, "deprecated": false, "signature_type": "Line", "id": "CVE-2022-49390-37dcb084" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d130282179aa6051449ac8f8df1115769998a665", "signature_version": "v1", "target": { "file": "drivers/net/macsec.c", "function": "macsec_free_netdev" }, "digest": { "length": 149.0, "function_hash": "133298807134360131036355873865255580214" }, "deprecated": false, "signature_type": "Function", "id": "CVE-2022-49390-45abd7a4" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d130282179aa6051449ac8f8df1115769998a665", "signature_version": "v1", "target": { "file": "drivers/net/macsec.c" }, "digest": { "line_hashes": [ "94838268209777072685933967372110725461", "108300532954511183856245307250976855960", "107485027214517644763938070234913637817", "322256779107262978926529581078177029203", "233897599446611416132264001831098838813", "100760215041285354904804334363595525713", "170690726430864746021570246615604158995", "328676940738296094076318639409859839157", "221483060195464846380024910175412184951", "17464071169014596474933706965992032134", "8279904749182720410446308718304623312", "35341229327224431492700492042555578046" ], "threshold": 0.9 }, "deprecated": false, "signature_type": "Line", "id": "CVE-2022-49390-7ad3e63f" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@78933cbc143b82d02330e00900d2fd08f2682f4e", "signature_version": "v1", "target": { "file": "drivers/net/macsec.c" }, "digest": { "line_hashes": [ "94838268209777072685933967372110725461", "108300532954511183856245307250976855960", "107485027214517644763938070234913637817", "322256779107262978926529581078177029203", "233897599446611416132264001831098838813", "100760215041285354904804334363595525713", "170690726430864746021570246615604158995", "328676940738296094076318639409859839157", "221483060195464846380024910175412184951", "17464071169014596474933706965992032134", "8279904749182720410446308718304623312", "35341229327224431492700492042555578046" ], "threshold": 0.9 }, "deprecated": false, "signature_type": "Line", "id": "CVE-2022-49390-8aebfd36" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@196a888ca6571deb344468e1d7138e3273206335", "signature_version": "v1", "target": { "file": "drivers/net/macsec.c", "function": "macsec_free_netdev" }, "digest": { "length": 149.0, "function_hash": "133298807134360131036355873865255580214" }, "deprecated": false, "signature_type": "Function", "id": "CVE-2022-49390-8f16fc86" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d130282179aa6051449ac8f8df1115769998a665", "signature_version": "v1", "target": { "file": "drivers/net/macsec.c", "function": "macsec_dev_init" }, "digest": { "length": 875.0, "function_hash": "25872192223660054141787646737134360713" }, "deprecated": false, "signature_type": "Function", "id": "CVE-2022-49390-c726962b" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@196a888ca6571deb344468e1d7138e3273206335", "signature_version": "v1", "target": { "file": "drivers/net/macsec.c", "function": "macsec_dev_init" }, "digest": { "length": 875.0, "function_hash": "25872192223660054141787646737134360713" }, "deprecated": false, "signature_type": "Function", "id": "CVE-2022-49390-f5570a0c" } ]