In the Linux kernel, the following vulnerability has been resolved:
net: tun: unlink NAPI from device on destruction
Syzbot found a race between tun file and device destruction. NAPIs live in struct tun_file which can get destroyed before the netdev so we have to del them explicitly. The current code is missing deleting the NAPI if the queue was detached first.
[
{
"digest": {
"line_hashes": [
"330313172933006471816493187256974665381",
"259195987956592736370485901140830591562",
"216459364870274576105737396118701868841",
"319462005557376957251053872074639731893"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2022-49672-2fa65f2c",
"target": {
"file": "drivers/net/tun.c"
},
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3b9bc84d311104906d2b4995a9a02d7b7ddab2db"
},
{
"digest": {
"length": 1132.0,
"function_hash": "118517579838096438241193686648004353931"
},
"deprecated": false,
"id": "CVE-2022-49672-36910b26",
"target": {
"function": "tun_detach_all",
"file": "drivers/net/tun.c"
},
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3b9bc84d311104906d2b4995a9a02d7b7ddab2db"
},
{
"digest": {
"line_hashes": [
"330313172933006471816493187256974665381",
"259195987956592736370485901140830591562",
"216459364870274576105737396118701868841",
"319462005557376957251053872074639731893"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2022-49672-59320638",
"target": {
"file": "drivers/net/tun.c"
},
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bec1be0a745ab420718217e3e0d9542a75108989"
},
{
"digest": {
"line_hashes": [
"330313172933006471816493187256974665381",
"259195987956592736370485901140830591562",
"216459364870274576105737396118701868841",
"319462005557376957251053872074639731893"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2022-49672-73290a37",
"target": {
"file": "drivers/net/tun.c"
},
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@82e729aee59acefe135fceffadcbc5b86dd4f1b9"
},
{
"digest": {
"line_hashes": [
"330313172933006471816493187256974665381",
"259195987956592736370485901140830591562",
"216459364870274576105737396118701868841",
"319462005557376957251053872074639731893"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2022-49672-8f289e37",
"target": {
"file": "drivers/net/tun.c"
},
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8661d4b8faa2f7ee7a559969c0a7c57f077b1728"
},
{
"digest": {
"line_hashes": [
"330313172933006471816493187256974665381",
"259195987956592736370485901140830591562",
"216459364870274576105737396118701868841",
"319462005557376957251053872074639731893"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2022-49672-8f680bb3",
"target": {
"file": "drivers/net/tun.c"
},
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8145f77d38de4f88b8a69e1463f5c09ba189d77c"
},
{
"digest": {
"length": 1132.0,
"function_hash": "118517579838096438241193686648004353931"
},
"deprecated": false,
"id": "CVE-2022-49672-b571c54b",
"target": {
"function": "tun_detach_all",
"file": "drivers/net/tun.c"
},
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bec1be0a745ab420718217e3e0d9542a75108989"
},
{
"digest": {
"length": 1132.0,
"function_hash": "118517579838096438241193686648004353931"
},
"deprecated": false,
"id": "CVE-2022-49672-c2042a3d",
"target": {
"function": "tun_detach_all",
"file": "drivers/net/tun.c"
},
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@82e729aee59acefe135fceffadcbc5b86dd4f1b9"
},
{
"digest": {
"length": 1132.0,
"function_hash": "118517579838096438241193686648004353931"
},
"deprecated": false,
"id": "CVE-2022-49672-d077981a",
"target": {
"function": "tun_detach_all",
"file": "drivers/net/tun.c"
},
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8145f77d38de4f88b8a69e1463f5c09ba189d77c"
},
{
"digest": {
"length": 1132.0,
"function_hash": "118517579838096438241193686648004353931"
},
"deprecated": false,
"id": "CVE-2022-49672-d1b91f19",
"target": {
"function": "tun_detach_all",
"file": "drivers/net/tun.c"
},
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a8cf919022373c97a84fe596bbea544f909c485d"
},
{
"digest": {
"length": 1132.0,
"function_hash": "118517579838096438241193686648004353931"
},
"deprecated": false,
"id": "CVE-2022-49672-ea370377",
"target": {
"function": "tun_detach_all",
"file": "drivers/net/tun.c"
},
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8661d4b8faa2f7ee7a559969c0a7c57f077b1728"
},
{
"digest": {
"line_hashes": [
"330313172933006471816493187256974665381",
"259195987956592736370485901140830591562",
"216459364870274576105737396118701868841",
"319462005557376957251053872074639731893"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2022-49672-f2408eb5",
"target": {
"file": "drivers/net/tun.c"
},
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a8cf919022373c97a84fe596bbea544f909c485d"
}
]