In the Linux kernel, the following vulnerability has been resolved:
net: sched: Fix use after free in red_enqueue()
We can't use "skb" again after passing it to qdiscenqueue(). This is basically identical to commit 2f09707d0c97 ("schsfb: Also store skb len before calling child enqueue").
{ "vanir_signatures": [ { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@52e0429471976785c155bfbf51d80990c6cd46e2", "signature_type": "Line", "target": { "file": "net/sched/sch_red.c" }, "deprecated": false, "digest": { "line_hashes": [ "192531147085050068834191302432117243778", "124182315671292368484820847362800259915", "139992063522967074266322247809775624419", "88835700288784378946979978802925552182", "238408996250176060354138387333155817978", "24556134588249622245802553928467538458", "337739708821218133086594982773133412727", "143996816025177834349201376235885603347", "158760800660824753687473704956946911553", "234483047561661781226750151888750938724" ], "threshold": 0.9 }, "id": "CVE-2022-49921-0afa8cd5" }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@170e5317042c302777ed6d59fdb84af9b0219d4e", "signature_type": "Line", "target": { "file": "net/sched/sch_red.c" }, "deprecated": false, "digest": { "line_hashes": [ "192531147085050068834191302432117243778", "124182315671292368484820847362800259915", "139992063522967074266322247809775624419", "88835700288784378946979978802925552182", "224431968947127007508610707247100383741", "24556134588249622245802553928467538458", "337739708821218133086594982773133412727", "143996816025177834349201376235885603347", "158760800660824753687473704956946911553", "234483047561661781226750151888750938724" ], "threshold": 0.9 }, "id": "CVE-2022-49921-319ac599" }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5960b9081baca85cc7dcb14aec1de85999ea9d36", "signature_type": "Function", "target": { "function": "red_enqueue", "file": "net/sched/sch_red.c" }, "deprecated": false, "digest": { "length": 1666.0, "function_hash": "9708761745453125378672810888427447096" }, "id": "CVE-2022-49921-4c604d7a" }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8bdc2acd420c6f3dd1f1c78750ec989f02a1e2b9", "signature_type": "Function", "target": { "function": "red_enqueue", "file": "net/sched/sch_red.c" }, "deprecated": false, "digest": { "length": 1666.0, "function_hash": "9708761745453125378672810888427447096" }, "id": "CVE-2022-49921-5bb65af3" }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@795afe0b9bb6c915f0299a8e309936519be01619", "signature_type": "Function", "target": { "function": "red_enqueue", "file": "net/sched/sch_red.c" }, "deprecated": false, "digest": { "length": 1128.0, "function_hash": "339404001622148771571667296513148979395" }, "id": "CVE-2022-49921-7f1df2e5" }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a238cdcf2bdc72207c74375fc8be13ee549ca9db", "signature_type": "Line", "target": { "file": "net/sched/sch_red.c" }, "deprecated": false, "digest": { "line_hashes": [ "192531147085050068834191302432117243778", "124182315671292368484820847362800259915", "139992063522967074266322247809775624419", "88835700288784378946979978802925552182", "238408996250176060354138387333155817978", "24556134588249622245802553928467538458", "337739708821218133086594982773133412727", "143996816025177834349201376235885603347", "158760800660824753687473704956946911553", "234483047561661781226750151888750938724" ], "threshold": 0.9 }, "id": "CVE-2022-49921-830baa32" }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e877f8fa49fbccc63cb2df2e9179bddc695b825a", "signature_type": "Function", "target": { "function": "red_enqueue", "file": "net/sched/sch_red.c" }, "deprecated": false, "digest": { "length": 1128.0, "function_hash": "339404001622148771571667296513148979395" }, "id": "CVE-2022-49921-85926e89" }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e877f8fa49fbccc63cb2df2e9179bddc695b825a", "signature_type": "Line", "target": { "file": "net/sched/sch_red.c" }, "deprecated": false, "digest": { "line_hashes": [ "192531147085050068834191302432117243778", "124182315671292368484820847362800259915", "139992063522967074266322247809775624419", "88835700288784378946979978802925552182", "238408996250176060354138387333155817978", "24556134588249622245802553928467538458", "337739708821218133086594982773133412727", "143996816025177834349201376235885603347", "158760800660824753687473704956946911553", "234483047561661781226750151888750938724" ], "threshold": 0.9 }, "id": "CVE-2022-49921-903a8270" }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@170e5317042c302777ed6d59fdb84af9b0219d4e", "signature_type": "Function", "target": { "function": "red_enqueue", "file": "net/sched/sch_red.c" }, "deprecated": false, "digest": { "length": 1666.0, "function_hash": "9708761745453125378672810888427447096" }, "id": "CVE-2022-49921-9b1816db" }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8bdc2acd420c6f3dd1f1c78750ec989f02a1e2b9", "signature_type": "Line", "target": { "file": "net/sched/sch_red.c" }, "deprecated": false, "digest": { "line_hashes": [ "192531147085050068834191302432117243778", "124182315671292368484820847362800259915", "139992063522967074266322247809775624419", "88835700288784378946979978802925552182", "224431968947127007508610707247100383741", "24556134588249622245802553928467538458", "337739708821218133086594982773133412727", "143996816025177834349201376235885603347", "158760800660824753687473704956946911553", "234483047561661781226750151888750938724" ], "threshold": 0.9 }, "id": "CVE-2022-49921-9b5ecbba" }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@795afe0b9bb6c915f0299a8e309936519be01619", "signature_type": "Line", "target": { "file": "net/sched/sch_red.c" }, "deprecated": false, "digest": { "line_hashes": [ "192531147085050068834191302432117243778", "124182315671292368484820847362800259915", "139992063522967074266322247809775624419", "88835700288784378946979978802925552182", "238408996250176060354138387333155817978", "24556134588249622245802553928467538458", "337739708821218133086594982773133412727", "143996816025177834349201376235885603347", "158760800660824753687473704956946911553", "234483047561661781226750151888750938724" ], "threshold": 0.9 }, "id": "CVE-2022-49921-a8e262c4" }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fc4b50adb400ee5ec527a04073174e8e73a139fa", "signature_type": "Line", "target": { "file": "net/sched/sch_red.c" }, "deprecated": false, "digest": { "line_hashes": [ "192531147085050068834191302432117243778", "124182315671292368484820847362800259915", "139992063522967074266322247809775624419", "88835700288784378946979978802925552182", "224431968947127007508610707247100383741", "24556134588249622245802553928467538458", "337739708821218133086594982773133412727", "143996816025177834349201376235885603347", "158760800660824753687473704956946911553", "234483047561661781226750151888750938724" ], "threshold": 0.9 }, "id": "CVE-2022-49921-af41cb00" }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fc4b50adb400ee5ec527a04073174e8e73a139fa", "signature_type": "Function", "target": { "function": "red_enqueue", "file": "net/sched/sch_red.c" }, "deprecated": false, "digest": { "length": 1666.0, "function_hash": "9708761745453125378672810888427447096" }, "id": "CVE-2022-49921-b5969b32" }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@52e0429471976785c155bfbf51d80990c6cd46e2", "signature_type": "Function", "target": { "function": "red_enqueue", "file": "net/sched/sch_red.c" }, "deprecated": false, "digest": { "length": 1128.0, "function_hash": "339404001622148771571667296513148979395" }, "id": "CVE-2022-49921-c7c8658b" }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5960b9081baca85cc7dcb14aec1de85999ea9d36", "signature_type": "Line", "target": { "file": "net/sched/sch_red.c" }, "deprecated": false, "digest": { "line_hashes": [ "192531147085050068834191302432117243778", "124182315671292368484820847362800259915", "139992063522967074266322247809775624419", "88835700288784378946979978802925552182", "224431968947127007508610707247100383741", "24556134588249622245802553928467538458", "337739708821218133086594982773133412727", "143996816025177834349201376235885603347", "158760800660824753687473704956946911553", "234483047561661781226750151888750938724" ], "threshold": 0.9 }, "id": "CVE-2022-49921-d01ca67e" }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a238cdcf2bdc72207c74375fc8be13ee549ca9db", "signature_type": "Function", "target": { "function": "red_enqueue", "file": "net/sched/sch_red.c" }, "deprecated": false, "digest": { "length": 1128.0, "function_hash": "339404001622148771571667296513148979395" }, "id": "CVE-2022-49921-db93ba5b" } ] }