In the Linux kernel, the following vulnerability has been resolved:
iouring/afunix: defer registered files gc to io_uring release
Instead of putting iouring's registered files in unixgc() we want it to be done by iouring itself. The trick here is to consider iouring registered files for cycle detection but not actually putting them down. Because iouring can't register other ring instances, this will remove all refs to the ring file triggering the ->release path and clean up with ioringctxfree().
[axboe: add kerneldoc comment to skb, fold in skb leak fix]
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b4293c01ee0d0ecdd3cb5801e13f62271144667a",
"target": {
"function": "io_scm_file_account",
"file": "io_uring/io_uring.c"
},
"id": "CVE-2022-50234-03b61b4a",
"deprecated": false,
"digest": {
"function_hash": "275838294700603795666376511470095169090",
"length": 1037.0
},
"signature_version": "v1",
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@813d8fe5d30388f73a21d3a2bf46b0a1fd72498c",
"target": {
"file": "fs/io_uring.c"
},
"id": "CVE-2022-50234-2b270235",
"deprecated": false,
"digest": {
"line_hashes": [
"130963554227973574097239886876174579270",
"194402192093679407668440943779907421679",
"289135723392546415403240523067799779580",
"96719925412896931610712381074426604933"
],
"threshold": 0.9
},
"signature_version": "v1",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@04df9719df1865f6770af9bc7880874af0e594b2",
"target": {
"file": "net/unix/garbage.c"
},
"id": "CVE-2022-50234-2dd55e61",
"deprecated": false,
"digest": {
"line_hashes": [
"318653652736790378849359559626911688848",
"297238899198689529727313014689430481691",
"85219207867798780437537915573641169563",
"209243694360001099721413407384401843307",
"309412793924642549722259659644542776499",
"228213226336470688300262573207734170597",
"14724550577973289444619736503057299778",
"308299746088851658522128383868019164424",
"44301314249337182914945560063807490201"
],
"threshold": 0.9
},
"signature_version": "v1",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0091bfc81741b8d3aeb3b7ab8636f911b2de6e80",
"target": {
"file": "net/unix/garbage.c"
},
"id": "CVE-2022-50234-36d87e96",
"deprecated": false,
"digest": {
"line_hashes": [
"318653652736790378849359559626911688848",
"297238899198689529727313014689430481691",
"85219207867798780437537915573641169563",
"209243694360001099721413407384401843307",
"309412793924642549722259659644542776499",
"228213226336470688300262573207734170597",
"14724550577973289444619736503057299778",
"308299746088851658522128383868019164424",
"44301314249337182914945560063807490201"
],
"threshold": 0.9
},
"signature_version": "v1",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@75e94c7e8859e58aadc15a98cc9704edff47d4f2",
"target": {
"function": "__io_scm_file_account",
"file": "io_uring/rsrc.c"
},
"id": "CVE-2022-50234-3e349576",
"deprecated": false,
"digest": {
"function_hash": "31557235540813083416464474470835449366",
"length": 1030.0
},
"signature_version": "v1",
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@813d8fe5d30388f73a21d3a2bf46b0a1fd72498c",
"target": {
"function": "__io_sqe_files_scm",
"file": "fs/io_uring.c"
},
"id": "CVE-2022-50234-46fbdbe3",
"deprecated": false,
"digest": {
"function_hash": "308900778446411116648611979226425019897",
"length": 1055.0
},
"signature_version": "v1",
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@75e94c7e8859e58aadc15a98cc9704edff47d4f2",
"target": {
"file": "include/linux/skbuff.h"
},
"id": "CVE-2022-50234-51b0ad17",
"deprecated": false,
"digest": {
"line_hashes": [
"199356124484998986541923960760490755322",
"61737354700499825965764563762740983007",
"97773555658628914634490256070018763463",
"20842815038519308705073867885196305875",
"91699677458632120075773601437771365183",
"206846246234486882229128242691536334458",
"202184373832143908720029070036850335175"
],
"threshold": 0.9
},
"signature_version": "v1",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@04df9719df1865f6770af9bc7880874af0e594b2",
"target": {
"function": "__io_sqe_files_scm",
"file": "fs/io_uring.c"
},
"id": "CVE-2022-50234-52b39d14",
"deprecated": false,
"digest": {
"function_hash": "88851890601799323071056551446593247565",
"length": 838.0
},
"signature_version": "v1",
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@04df9719df1865f6770af9bc7880874af0e594b2",
"target": {
"function": "unix_gc",
"file": "net/unix/garbage.c"
},
"id": "CVE-2022-50234-5fda114f",
"deprecated": false,
"digest": {
"function_hash": "323495406744517316788257178335958752444",
"length": 1681.0
},
"signature_version": "v1",
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c378c479c5175833bb22ff71974cda47d7b05401",
"target": {
"file": "net/unix/garbage.c"
},
"id": "CVE-2022-50234-62213124",
"deprecated": false,
"digest": {
"line_hashes": [
"318653652736790378849359559626911688848",
"297238899198689529727313014689430481691",
"85219207867798780437537915573641169563",
"209243694360001099721413407384401843307",
"309412793924642549722259659644542776499",
"228213226336470688300262573207734170597",
"14724550577973289444619736503057299778",
"308299746088851658522128383868019164424",
"44301314249337182914945560063807490201"
],
"threshold": 0.9
},
"signature_version": "v1",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c378c479c5175833bb22ff71974cda47d7b05401",
"target": {
"function": "unix_gc",
"file": "net/unix/garbage.c"
},
"id": "CVE-2022-50234-6268cf24",
"deprecated": false,
"digest": {
"function_hash": "323495406744517316788257178335958752444",
"length": 1681.0
},
"signature_version": "v1",
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@75e94c7e8859e58aadc15a98cc9704edff47d4f2",
"target": {
"function": "unix_gc",
"file": "net/unix/garbage.c"
},
"id": "CVE-2022-50234-699fa229",
"deprecated": false,
"digest": {
"function_hash": "323495406744517316788257178335958752444",
"length": 1681.0
},
"signature_version": "v1",
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c378c479c5175833bb22ff71974cda47d7b05401",
"target": {
"file": "include/linux/skbuff.h"
},
"id": "CVE-2022-50234-79da4611",
"deprecated": false,
"digest": {
"line_hashes": [
"199356124484998986541923960760490755322",
"61737354700499825965764563762740983007",
"97773555658628914634490256070018763463",
"243057071019903823183024131343341349917",
"232770813265386771612749554050309875816",
"85150990163482233231056235816367631628",
"183616803117299701146923037241348557048"
],
"threshold": 0.9
},
"signature_version": "v1",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c378c479c5175833bb22ff71974cda47d7b05401",
"target": {
"file": "fs/io_uring.c"
},
"id": "CVE-2022-50234-866085ad",
"deprecated": false,
"digest": {
"line_hashes": [
"130963554227973574097239886876174579270",
"194402192093679407668440943779907421679",
"179555995777532969554302422954249927081",
"134306668431740548467513238187099239940"
],
"threshold": 0.9
},
"signature_version": "v1",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@04df9719df1865f6770af9bc7880874af0e594b2",
"target": {
"file": "fs/io_uring.c"
},
"id": "CVE-2022-50234-87dfcf4d",
"deprecated": false,
"digest": {
"line_hashes": [
"130963554227973574097239886876174579270",
"133588591258334967028654487340411344585",
"226152275608861589249666583158070899024",
"41266727386425845761455833661480254476"
],
"threshold": 0.9
},
"signature_version": "v1",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@813d8fe5d30388f73a21d3a2bf46b0a1fd72498c",
"target": {
"file": "net/unix/garbage.c"
},
"id": "CVE-2022-50234-891054a5",
"deprecated": false,
"digest": {
"line_hashes": [
"318653652736790378849359559626911688848",
"297238899198689529727313014689430481691",
"85219207867798780437537915573641169563",
"209243694360001099721413407384401843307",
"309412793924642549722259659644542776499",
"228213226336470688300262573207734170597",
"14724550577973289444619736503057299778",
"308299746088851658522128383868019164424",
"44301314249337182914945560063807490201"
],
"threshold": 0.9
},
"signature_version": "v1",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@813d8fe5d30388f73a21d3a2bf46b0a1fd72498c",
"target": {
"file": "include/linux/skbuff.h"
},
"id": "CVE-2022-50234-8cf287da",
"deprecated": false,
"digest": {
"line_hashes": [
"199356124484998986541923960760490755322",
"61737354700499825965764563762740983007",
"97773555658628914634490256070018763463",
"282793853649663692628823078743913531592",
"322308255095454480869666718644295658282",
"324505100814608420440603361800923855213",
"55560585289782870698867343664345438485"
],
"threshold": 0.9
},
"signature_version": "v1",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0091bfc81741b8d3aeb3b7ab8636f911b2de6e80",
"target": {
"file": "include/linux/skbuff.h"
},
"id": "CVE-2022-50234-94c499a2",
"deprecated": false,
"digest": {
"line_hashes": [
"199356124484998986541923960760490755322",
"61737354700499825965764563762740983007",
"97773555658628914634490256070018763463",
"20842815038519308705073867885196305875",
"91699677458632120075773601437771365183",
"206846246234486882229128242691536334458",
"202184373832143908720029070036850335175"
],
"threshold": 0.9
},
"signature_version": "v1",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c378c479c5175833bb22ff71974cda47d7b05401",
"target": {
"function": "__io_sqe_files_scm",
"file": "fs/io_uring.c"
},
"id": "CVE-2022-50234-a17b72b3",
"deprecated": false,
"digest": {
"function_hash": "96088109111906065173329055157515281470",
"length": 1056.0
},
"signature_version": "v1",
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@75e94c7e8859e58aadc15a98cc9704edff47d4f2",
"target": {
"file": "io_uring/rsrc.c"
},
"id": "CVE-2022-50234-b40be3b1",
"deprecated": false,
"digest": {
"line_hashes": [
"317897263367588257350871281748430520221",
"326743831142077172259424468683610830372",
"265790760448308151487932890317555037233",
"194973448039452944797667526201171913487"
],
"threshold": 0.9
},
"signature_version": "v1",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b4293c01ee0d0ecdd3cb5801e13f62271144667a",
"target": {
"function": "unix_gc",
"file": "net/unix/garbage.c"
},
"id": "CVE-2022-50234-b94ef821",
"deprecated": false,
"digest": {
"function_hash": "323495406744517316788257178335958752444",
"length": 1681.0
},
"signature_version": "v1",
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0091bfc81741b8d3aeb3b7ab8636f911b2de6e80",
"target": {
"function": "__io_scm_file_account",
"file": "io_uring/rsrc.c"
},
"id": "CVE-2022-50234-babae6c3",
"deprecated": false,
"digest": {
"function_hash": "31557235540813083416464474470835449366",
"length": 1030.0
},
"signature_version": "v1",
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@04df9719df1865f6770af9bc7880874af0e594b2",
"target": {
"file": "include/linux/skbuff.h"
},
"id": "CVE-2022-50234-bfb6049c",
"deprecated": false,
"digest": {
"line_hashes": [
"199356124484998986541923960760490755322",
"61737354700499825965764563762740983007",
"97773555658628914634490256070018763463",
"243057071019903823183024131343341349917",
"232770813265386771612749554050309875816",
"85150990163482233231056235816367631628",
"183616803117299701146923037241348557048"
],
"threshold": 0.9
},
"signature_version": "v1",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0091bfc81741b8d3aeb3b7ab8636f911b2de6e80",
"target": {
"file": "io_uring/rsrc.c"
},
"id": "CVE-2022-50234-c49066c6",
"deprecated": false,
"digest": {
"line_hashes": [
"317897263367588257350871281748430520221",
"326743831142077172259424468683610830372",
"265790760448308151487932890317555037233",
"194973448039452944797667526201171913487"
],
"threshold": 0.9
},
"signature_version": "v1",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@813d8fe5d30388f73a21d3a2bf46b0a1fd72498c",
"target": {
"function": "unix_gc",
"file": "net/unix/garbage.c"
},
"id": "CVE-2022-50234-d0a364cb",
"deprecated": false,
"digest": {
"function_hash": "323495406744517316788257178335958752444",
"length": 1681.0
},
"signature_version": "v1",
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b4293c01ee0d0ecdd3cb5801e13f62271144667a",
"target": {
"file": "net/unix/garbage.c"
},
"id": "CVE-2022-50234-d51d06d8",
"deprecated": false,
"digest": {
"line_hashes": [
"318653652736790378849359559626911688848",
"297238899198689529727313014689430481691",
"85219207867798780437537915573641169563",
"209243694360001099721413407384401843307",
"309412793924642549722259659644542776499",
"228213226336470688300262573207734170597",
"14724550577973289444619736503057299778",
"308299746088851658522128383868019164424",
"44301314249337182914945560063807490201"
],
"threshold": 0.9
},
"signature_version": "v1",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b4293c01ee0d0ecdd3cb5801e13f62271144667a",
"target": {
"file": "io_uring/io_uring.c"
},
"id": "CVE-2022-50234-d98a362b",
"deprecated": false,
"digest": {
"line_hashes": [
"317897263367588257350871281748430520221",
"326743831142077172259424468683610830372",
"265790760448308151487932890317555037233",
"194973448039452944797667526201171913487"
],
"threshold": 0.9
},
"signature_version": "v1",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b4293c01ee0d0ecdd3cb5801e13f62271144667a",
"target": {
"file": "include/linux/skbuff.h"
},
"id": "CVE-2022-50234-e9c00f6b",
"deprecated": false,
"digest": {
"line_hashes": [
"199356124484998986541923960760490755322",
"61737354700499825965764563762740983007",
"97773555658628914634490256070018763463",
"20842815038519308705073867885196305875",
"91699677458632120075773601437771365183",
"206846246234486882229128242691536334458",
"202184373832143908720029070036850335175"
],
"threshold": 0.9
},
"signature_version": "v1",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@75e94c7e8859e58aadc15a98cc9704edff47d4f2",
"target": {
"file": "net/unix/garbage.c"
},
"id": "CVE-2022-50234-ebc0734c",
"deprecated": false,
"digest": {
"line_hashes": [
"318653652736790378849359559626911688848",
"297238899198689529727313014689430481691",
"85219207867798780437537915573641169563",
"209243694360001099721413407384401843307",
"309412793924642549722259659644542776499",
"228213226336470688300262573207734170597",
"14724550577973289444619736503057299778",
"308299746088851658522128383868019164424",
"44301314249337182914945560063807490201"
],
"threshold": 0.9
},
"signature_version": "v1",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0091bfc81741b8d3aeb3b7ab8636f911b2de6e80",
"target": {
"function": "unix_gc",
"file": "net/unix/garbage.c"
},
"id": "CVE-2022-50234-f03b7af9",
"deprecated": false,
"digest": {
"function_hash": "323495406744517316788257178335958752444",
"length": 1681.0
},
"signature_version": "v1",
"signature_type": "Function"
}
]