In the Linux kernel, the following vulnerability has been resolved:
net: bonding: fix use-after-free after 802.3ad slave unbind
commit 0622cab0341c ("bonding: fix 802.3ad aggregator reselection"), resolve case, when there is several aggregation groups in the same bond. bond3adunbindslave will invalidate (clear) aggregator when _aggactiveports return zero. So, adclearagg can be executed even, when numofports!=0. Than bond3adunbindslave can be executed again for, previously cleared aggregator. NOTE: at this time bond3adunbindslave will not update slave ports list, because lag_ports==NULL. So, here we got slave ports, pointing to freed aggregator memory.
Fix with checking actual number of ports in group (as was before commit 0622cab0341c ("bonding: fix 802.3ad aggregator reselection") ), before adclearagg().
The KASAN logs are as follows:
[ 767.617392] ================================================================== [ 767.630776] BUG: KASAN: use-after-free in bond3adstatemachinehandler+0x13dc/0x1470 [ 767.638764] Read of size 2 at addr ffff00011ba9d430 by task kworker/u8:7/767 [ 767.647361] CPU: 3 PID: 767 Comm: kworker/u8:7 Tainted: G O 5.15.11 #15 [ 767.655329] Hardware name: DNI AmazonGo1 A7040 board (DT) [ 767.660760] Workqueue: lacp1 bond3adstatemachinehandler [ 767.666468] Call trace: [ 767.668930] dumpbacktrace+0x0/0x2d0 [ 767.672625] showstack+0x24/0x30 [ 767.675965] dumpstacklvl+0x68/0x84 [ 767.679659] printaddressdescription.constprop.0+0x74/0x2b8 [ 767.685451] kasanreport+0x1f0/0x260 [ 767.689148] _asanload2+0x94/0xd0 [ 767.692667] bond3adstatemachinehandler+0x13dc/0x1470
[
{
"id": "CVE-2022-49667-017d4a71",
"signature_type": "Line",
"digest": {
"line_hashes": [
"312543026571800232995254207401845141405",
"286819470085155317812116930445153107612",
"152335222739267707558033031847678114895",
"2387205168097093901253180590753119117"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2765749def4765c5052a4c66445cf4c96fcccdbc",
"target": {
"file": "drivers/net/bonding/bond_3ad.c"
}
},
{
"id": "CVE-2022-49667-0c791dab",
"signature_type": "Line",
"digest": {
"line_hashes": [
"312543026571800232995254207401845141405",
"286819470085155317812116930445153107612",
"321910411220684119105676546162743242887",
"126541791840775535775733871522964332667"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f162f7c348fa2a5555bafdb5cc890b89b221e69c",
"target": {
"file": "drivers/net/bonding/bond_3ad.c"
}
},
{
"id": "CVE-2022-49667-1342e34e",
"signature_type": "Line",
"digest": {
"line_hashes": [
"312543026571800232995254207401845141405",
"286819470085155317812116930445153107612",
"152335222739267707558033031847678114895",
"2387205168097093901253180590753119117"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ef0af7d08d26c5333ff4944a559279464edf6f15",
"target": {
"file": "drivers/net/bonding/bond_3ad.c"
}
},
{
"id": "CVE-2022-49667-1ba47e5b",
"signature_type": "Line",
"digest": {
"line_hashes": [
"312543026571800232995254207401845141405",
"286819470085155317812116930445153107612",
"152335222739267707558033031847678114895",
"2387205168097093901253180590753119117"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@050133e1aa2cb49bb17be847d48a4431598ef562",
"target": {
"file": "drivers/net/bonding/bond_3ad.c"
}
},
{
"id": "CVE-2022-49667-26b67393",
"signature_type": "Line",
"digest": {
"line_hashes": [
"312543026571800232995254207401845141405",
"286819470085155317812116930445153107612",
"152335222739267707558033031847678114895",
"2387205168097093901253180590753119117"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@893825289ba840afd86bfffcb6f7f363c73efff8",
"target": {
"file": "drivers/net/bonding/bond_3ad.c"
}
},
{
"id": "CVE-2022-49667-3a7a9b66",
"signature_type": "Function",
"digest": {
"length": 3401.0,
"function_hash": "27997106169256380818783275766667545588"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f162f7c348fa2a5555bafdb5cc890b89b221e69c",
"target": {
"function": "bond_3ad_unbind_slave",
"file": "drivers/net/bonding/bond_3ad.c"
}
},
{
"id": "CVE-2022-49667-42fc515b",
"signature_type": "Function",
"digest": {
"length": 3401.0,
"function_hash": "27997106169256380818783275766667545588"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b90ac60303063a43e17dd4aec159067599d255e6",
"target": {
"function": "bond_3ad_unbind_slave",
"file": "drivers/net/bonding/bond_3ad.c"
}
},
{
"id": "CVE-2022-49667-54b4fa2f",
"signature_type": "Function",
"digest": {
"length": 3500.0,
"function_hash": "234670156641848078058237601046401249988"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2765749def4765c5052a4c66445cf4c96fcccdbc",
"target": {
"function": "bond_3ad_unbind_slave",
"file": "drivers/net/bonding/bond_3ad.c"
}
},
{
"id": "CVE-2022-49667-59f95124",
"signature_type": "Function",
"digest": {
"length": 3401.0,
"function_hash": "27997106169256380818783275766667545588"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a853b7a3a9fd1d74a4ccdd9cd73512b7dace2f1e",
"target": {
"function": "bond_3ad_unbind_slave",
"file": "drivers/net/bonding/bond_3ad.c"
}
},
{
"id": "CVE-2022-49667-5c373d78",
"signature_type": "Function",
"digest": {
"length": 3492.0,
"function_hash": "198237762670257006686468118250517614664"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@893825289ba840afd86bfffcb6f7f363c73efff8",
"target": {
"function": "bond_3ad_unbind_slave",
"file": "drivers/net/bonding/bond_3ad.c"
}
},
{
"id": "CVE-2022-49667-86e09148",
"signature_type": "Function",
"digest": {
"length": 3500.0,
"function_hash": "234670156641848078058237601046401249988"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@050133e1aa2cb49bb17be847d48a4431598ef562",
"target": {
"function": "bond_3ad_unbind_slave",
"file": "drivers/net/bonding/bond_3ad.c"
}
},
{
"id": "CVE-2022-49667-9182c266",
"signature_type": "Function",
"digest": {
"length": 3500.0,
"function_hash": "234670156641848078058237601046401249988"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@63b2fe509f69b90168a75e04e14573dccf7984e6",
"target": {
"function": "bond_3ad_unbind_slave",
"file": "drivers/net/bonding/bond_3ad.c"
}
},
{
"id": "CVE-2022-49667-95e12ebf",
"signature_type": "Line",
"digest": {
"line_hashes": [
"312543026571800232995254207401845141405",
"286819470085155317812116930445153107612",
"321910411220684119105676546162743242887",
"126541791840775535775733871522964332667"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b90ac60303063a43e17dd4aec159067599d255e6",
"target": {
"file": "drivers/net/bonding/bond_3ad.c"
}
},
{
"id": "CVE-2022-49667-d80fdceb",
"signature_type": "Line",
"digest": {
"line_hashes": [
"312543026571800232995254207401845141405",
"286819470085155317812116930445153107612",
"152335222739267707558033031847678114895",
"2387205168097093901253180590753119117"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@63b2fe509f69b90168a75e04e14573dccf7984e6",
"target": {
"file": "drivers/net/bonding/bond_3ad.c"
}
},
{
"id": "CVE-2022-49667-e67c9b77",
"signature_type": "Line",
"digest": {
"line_hashes": [
"312543026571800232995254207401845141405",
"286819470085155317812116930445153107612",
"321910411220684119105676546162743242887",
"126541791840775535775733871522964332667"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a853b7a3a9fd1d74a4ccdd9cd73512b7dace2f1e",
"target": {
"file": "drivers/net/bonding/bond_3ad.c"
}
},
{
"id": "CVE-2022-49667-f88a526a",
"signature_type": "Function",
"digest": {
"length": 3500.0,
"function_hash": "234670156641848078058237601046401249988"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ef0af7d08d26c5333ff4944a559279464edf6f15",
"target": {
"function": "bond_3ad_unbind_slave",
"file": "drivers/net/bonding/bond_3ad.c"
}
}
]