In the Linux kernel, the following vulnerability has been resolved:
macsec: fix UAF bug for real_dev
Create a new macsec device but not get reference to realdev. That can not ensure that realdev is freed after macsec. That will trigger the UAF bug for real_dev as following:
================================================================== BUG: KASAN: use-after-free in macsecgetiflink+0x5f/0x70 drivers/net/macsec.c:3662 Call Trace: ... macsecgetiflink+0x5f/0x70 drivers/net/macsec.c:3662 devgetiflink+0x73/0xe0 net/core/dev.c:637 defaultoperstate net/core/linkwatch.c:42 [inline] rfc2863policy+0x233/0x2d0 net/core/linkwatch.c:54 linkwatchdodev+0x2a/0x150 net/core/link_watch.c:161
Allocated by task 22209: ... allocnetdevmqs+0x98/0x1100 net/core/dev.c:10549 rtnlcreatelink+0x9d7/0xc00 net/core/rtnetlink.c:3235 veth_newlink+0x20e/0xa90 drivers/net/veth.c:1748
Freed by task 8: ... kfree+0xd6/0x4d0 mm/slub.c:4552 kvfree+0x42/0x50 mm/util.c:615 devicerelease+0x9f/0x240 drivers/base/core.c:2229 kobjectcleanup lib/kobject.c:673 [inline] kobjectrelease lib/kobject.c:704 [inline] krefput include/linux/kref.h:65 [inline] kobjectput+0x1c8/0x540 lib/kobject.c:721 netdevrun_todo+0x72e/0x10b0 net/core/dev.c:10327
After commit faab39f63c1f ("net: allow out-of-order netdev unregistration") and commit e5f80fcf869a ("ipv6: give an IPv6 dev to blackholenetdev"), we can add devholdtrack() in macsecdevinit() and devputtrack() in macsecfree_netdev() to fix the problem.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49390.json",
"cna_assigner": "Linux"
}[
{
"id": "CVE-2022-49390-099b832b",
"signature_version": "v1",
"digest": {
"function_hash": "25872192223660054141787646737134360713",
"length": 875.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@78933cbc143b82d02330e00900d2fd08f2682f4e",
"signature_type": "Function",
"target": {
"file": "drivers/net/macsec.c",
"function": "macsec_dev_init"
}
},
{
"id": "CVE-2022-49390-2872bded",
"signature_version": "v1",
"digest": {
"function_hash": "133298807134360131036355873865255580214",
"length": 149.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@78933cbc143b82d02330e00900d2fd08f2682f4e",
"signature_type": "Function",
"target": {
"file": "drivers/net/macsec.c",
"function": "macsec_free_netdev"
}
},
{
"id": "CVE-2022-49390-37dcb084",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"94838268209777072685933967372110725461",
"108300532954511183856245307250976855960",
"107485027214517644763938070234913637817",
"322256779107262978926529581078177029203",
"233897599446611416132264001831098838813",
"100760215041285354904804334363595525713",
"170690726430864746021570246615604158995",
"328676940738296094076318639409859839157",
"221483060195464846380024910175412184951",
"17464071169014596474933706965992032134",
"8279904749182720410446308718304623312",
"35341229327224431492700492042555578046"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@196a888ca6571deb344468e1d7138e3273206335",
"signature_type": "Line",
"target": {
"file": "drivers/net/macsec.c"
}
},
{
"id": "CVE-2022-49390-45abd7a4",
"signature_version": "v1",
"digest": {
"function_hash": "133298807134360131036355873865255580214",
"length": 149.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d130282179aa6051449ac8f8df1115769998a665",
"signature_type": "Function",
"target": {
"file": "drivers/net/macsec.c",
"function": "macsec_free_netdev"
}
},
{
"id": "CVE-2022-49390-7ad3e63f",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"94838268209777072685933967372110725461",
"108300532954511183856245307250976855960",
"107485027214517644763938070234913637817",
"322256779107262978926529581078177029203",
"233897599446611416132264001831098838813",
"100760215041285354904804334363595525713",
"170690726430864746021570246615604158995",
"328676940738296094076318639409859839157",
"221483060195464846380024910175412184951",
"17464071169014596474933706965992032134",
"8279904749182720410446308718304623312",
"35341229327224431492700492042555578046"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d130282179aa6051449ac8f8df1115769998a665",
"signature_type": "Line",
"target": {
"file": "drivers/net/macsec.c"
}
},
{
"id": "CVE-2022-49390-8aebfd36",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"94838268209777072685933967372110725461",
"108300532954511183856245307250976855960",
"107485027214517644763938070234913637817",
"322256779107262978926529581078177029203",
"233897599446611416132264001831098838813",
"100760215041285354904804334363595525713",
"170690726430864746021570246615604158995",
"328676940738296094076318639409859839157",
"221483060195464846380024910175412184951",
"17464071169014596474933706965992032134",
"8279904749182720410446308718304623312",
"35341229327224431492700492042555578046"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@78933cbc143b82d02330e00900d2fd08f2682f4e",
"signature_type": "Line",
"target": {
"file": "drivers/net/macsec.c"
}
},
{
"id": "CVE-2022-49390-8f16fc86",
"signature_version": "v1",
"digest": {
"function_hash": "133298807134360131036355873865255580214",
"length": 149.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@196a888ca6571deb344468e1d7138e3273206335",
"signature_type": "Function",
"target": {
"file": "drivers/net/macsec.c",
"function": "macsec_free_netdev"
}
},
{
"id": "CVE-2022-49390-c726962b",
"signature_version": "v1",
"digest": {
"function_hash": "25872192223660054141787646737134360713",
"length": 875.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d130282179aa6051449ac8f8df1115769998a665",
"signature_type": "Function",
"target": {
"file": "drivers/net/macsec.c",
"function": "macsec_dev_init"
}
},
{
"id": "CVE-2022-49390-f5570a0c",
"signature_version": "v1",
"digest": {
"function_hash": "25872192223660054141787646737134360713",
"length": 875.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@196a888ca6571deb344468e1d7138e3273206335",
"signature_type": "Function",
"target": {
"file": "drivers/net/macsec.c",
"function": "macsec_dev_init"
}
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-49390.json"