In the Linux kernel, the following vulnerability has been resolved:
sctp: handle the error returned from sctpauthasocinitactive_key
When it returns an error from sctpauthasocinitactivekey(), the activekey is actually not updated. The old sh_key will be freeed while it's still used as active key in asoc. Then an use-after-free will be triggered when sending patckets, as found by syzbot:
sctpauthshkeyhold+0x22/0xa0 net/sctp/auth.c:112 sctpsetownerw net/sctp/socket.c:132 [inline] sctpsendmsgtoasoc+0xbd5/0x1a20 net/sctp/socket.c:1863 sctpsendmsg+0x1053/0x1d50 net/sctp/socket.c:2025 inetsendmsg+0x99/0xe0 net/ipv4/afinet.c:819 socksendmsgnosec net/socket.c:714 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:734
This patch is to fix it by not replacing the shkey when it returns errors from sctpauthasocinitactivekey() in sctpauthsetkey(). For sctpauthsetactivekey(), old activekeyid will be set back to asoc->activekey_id when the same thing happens.
[ { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3b0fcf5e29c0940e1169ce9c44f73edd98bdf12d", "target": { "file": "net/sctp/auth.c" }, "signature_type": "Line", "deprecated": false, "signature_version": "v1", "id": "CVE-2022-50243-04163ce8", "digest": { "line_hashes": [ "28850636265357495592566577798945945186", "194067361854653024968251076671750102684", "286406572356836389561447667215631747182", "273944544286126911343132522615425576427", "313505225112280038328754988666955331497", "306127955805276017219327529626874094931", "11073258240307341960273669284712426231", "28538450641731605929138508953941427174", "280031296272510654103448174463959325454", "238396630738222518784509270232605763931", "175898317047138494819711557848387272072", "211182195896578399788160970086209014145", "12322489886649053390420358454097650829" ], "threshold": 0.9 } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@022152aaebe116a25c39818a07e175a8cd3c1e11", "target": { "function": "sctp_auth_set_active_key", "file": "net/sctp/auth.c" }, "signature_type": "Function", "deprecated": false, "signature_version": "v1", "id": "CVE-2022-50243-07026e3d", "digest": { "function_hash": "260642530473383737724352416597912646283", "length": 588.0 } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b8fa99a3a11bdd77fef6b4a97f1021eb30b5ba40", "target": { "file": "net/sctp/auth.c" }, "signature_type": "Line", "deprecated": false, "signature_version": "v1", "id": "CVE-2022-50243-1c3163ec", "digest": { "line_hashes": [ "28850636265357495592566577798945945186", "194067361854653024968251076671750102684", "286406572356836389561447667215631747182", "273944544286126911343132522615425576427", "313505225112280038328754988666955331497", "306127955805276017219327529626874094931", "11073258240307341960273669284712426231", "28538450641731605929138508953941427174", "280031296272510654103448174463959325454", "238396630738222518784509270232605763931", "175898317047138494819711557848387272072", "211182195896578399788160970086209014145", "12322489886649053390420358454097650829" ], "threshold": 0.9 } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@19d636b663e0e92951bba5fced929ca7fd25c552", "target": { "file": "net/sctp/auth.c" }, "signature_type": "Line", "deprecated": false, "signature_version": "v1", "id": "CVE-2022-50243-21ea5031", "digest": { "line_hashes": [ "28850636265357495592566577798945945186", "194067361854653024968251076671750102684", "286406572356836389561447667215631747182", "273944544286126911343132522615425576427", "313505225112280038328754988666955331497", "306127955805276017219327529626874094931", "11073258240307341960273669284712426231", "28538450641731605929138508953941427174", "280031296272510654103448174463959325454", "238396630738222518784509270232605763931", "175898317047138494819711557848387272072", "211182195896578399788160970086209014145", "12322489886649053390420358454097650829" ], "threshold": 0.9 } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@382ff44716603a54f5fd238ddec6a2468e217612", "target": { "function": "sctp_auth_set_key", "file": "net/sctp/auth.c" }, "signature_type": "Function", "deprecated": false, "signature_version": "v1", "id": "CVE-2022-50243-242729c5", "digest": { "function_hash": "65183161759657524099937178786571949990", "length": 1009.0 } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@022152aaebe116a25c39818a07e175a8cd3c1e11", "target": { "file": "net/sctp/auth.c" }, "signature_type": "Line", "deprecated": false, "signature_version": "v1", "id": "CVE-2022-50243-2ed662bd", "digest": { "line_hashes": [ "28850636265357495592566577798945945186", "194067361854653024968251076671750102684", "286406572356836389561447667215631747182", "273944544286126911343132522615425576427", "313505225112280038328754988666955331497", "306127955805276017219327529626874094931", "11073258240307341960273669284712426231", "28538450641731605929138508953941427174", "280031296272510654103448174463959325454", "238396630738222518784509270232605763931", "175898317047138494819711557848387272072", "211182195896578399788160970086209014145", "12322489886649053390420358454097650829" ], "threshold": 0.9 } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3b0fcf5e29c0940e1169ce9c44f73edd98bdf12d", "target": { "function": "sctp_auth_set_key", "file": "net/sctp/auth.c" }, "signature_type": "Function", "deprecated": false, "signature_version": "v1", "id": "CVE-2022-50243-3f9ed34c", "digest": { "function_hash": "65183161759657524099937178786571949990", "length": 1009.0 } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@382ff44716603a54f5fd238ddec6a2468e217612", "target": { "function": "sctp_auth_set_active_key", "file": "net/sctp/auth.c" }, "signature_type": "Function", "deprecated": false, "signature_version": "v1", "id": "CVE-2022-50243-409959c4", "digest": { "function_hash": "260642530473383737724352416597912646283", "length": 588.0 } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b8fa99a3a11bdd77fef6b4a97f1021eb30b5ba40", "target": { "function": "sctp_auth_set_active_key", "file": "net/sctp/auth.c" }, "signature_type": "Function", "deprecated": false, "signature_version": "v1", "id": "CVE-2022-50243-5dcdc997", "digest": { "function_hash": "258582217407888111275456618306297284921", "length": 476.0 } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f65955340e0044f5c41ac799a01698ac7dee8a4e", "target": { "file": "net/sctp/auth.c" }, "signature_type": "Line", "deprecated": false, "signature_version": "v1", "id": "CVE-2022-50243-624aa1ee", "digest": { "line_hashes": [ "28850636265357495592566577798945945186", "194067361854653024968251076671750102684", "286406572356836389561447667215631747182", "273944544286126911343132522615425576427", "313505225112280038328754988666955331497", "306127955805276017219327529626874094931", "11073258240307341960273669284712426231", "28538450641731605929138508953941427174", "280031296272510654103448174463959325454", "238396630738222518784509270232605763931", "175898317047138494819711557848387272072", "211182195896578399788160970086209014145", "12322489886649053390420358454097650829" ], "threshold": 0.9 } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3b0fcf5e29c0940e1169ce9c44f73edd98bdf12d", "target": { "function": "sctp_auth_set_active_key", "file": "net/sctp/auth.c" }, "signature_type": "Function", "deprecated": false, "signature_version": "v1", "id": "CVE-2022-50243-72fa019f", "digest": { "function_hash": "260642530473383737724352416597912646283", "length": 588.0 } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0f90099d18e3abdc01babf686f41f63fe04939c1", "target": { "function": "sctp_auth_set_key", "file": "net/sctp/auth.c" }, "signature_type": "Function", "deprecated": false, "signature_version": "v1", "id": "CVE-2022-50243-8e7a3a22", "digest": { "function_hash": "65183161759657524099937178786571949990", "length": 1009.0 } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@382ff44716603a54f5fd238ddec6a2468e217612", "target": { "file": "net/sctp/auth.c" }, "signature_type": "Line", "deprecated": false, "signature_version": "v1", "id": "CVE-2022-50243-91ab7614", "digest": { "line_hashes": [ "28850636265357495592566577798945945186", "194067361854653024968251076671750102684", "286406572356836389561447667215631747182", "273944544286126911343132522615425576427", "313505225112280038328754988666955331497", "306127955805276017219327529626874094931", "11073258240307341960273669284712426231", "28538450641731605929138508953941427174", "280031296272510654103448174463959325454", "238396630738222518784509270232605763931", "175898317047138494819711557848387272072", "211182195896578399788160970086209014145", "12322489886649053390420358454097650829" ], "threshold": 0.9 } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b8fa99a3a11bdd77fef6b4a97f1021eb30b5ba40", "target": { "function": "sctp_auth_set_key", "file": "net/sctp/auth.c" }, "signature_type": "Function", "deprecated": false, "signature_version": "v1", "id": "CVE-2022-50243-9b5975f8", "digest": { "function_hash": "129378499347910125544479108824918371736", "length": 897.0 } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f65955340e0044f5c41ac799a01698ac7dee8a4e", "target": { "function": "sctp_auth_set_key", "file": "net/sctp/auth.c" }, "signature_type": "Function", "deprecated": false, "signature_version": "v1", "id": "CVE-2022-50243-b216bef0", "digest": { "function_hash": "65183161759657524099937178786571949990", "length": 1009.0 } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f65955340e0044f5c41ac799a01698ac7dee8a4e", "target": { "function": "sctp_auth_set_active_key", "file": "net/sctp/auth.c" }, "signature_type": "Function", "deprecated": false, "signature_version": "v1", "id": "CVE-2022-50243-b370b349", "digest": { "function_hash": "260642530473383737724352416597912646283", "length": 588.0 } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0f90099d18e3abdc01babf686f41f63fe04939c1", "target": { "file": "net/sctp/auth.c" }, "signature_type": "Line", "deprecated": false, "signature_version": "v1", "id": "CVE-2022-50243-c666a31d", "digest": { "line_hashes": [ "28850636265357495592566577798945945186", "194067361854653024968251076671750102684", "286406572356836389561447667215631747182", "273944544286126911343132522615425576427", "313505225112280038328754988666955331497", "306127955805276017219327529626874094931", "11073258240307341960273669284712426231", "28538450641731605929138508953941427174", "280031296272510654103448174463959325454", "238396630738222518784509270232605763931", "175898317047138494819711557848387272072", "211182195896578399788160970086209014145", "12322489886649053390420358454097650829" ], "threshold": 0.9 } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0f90099d18e3abdc01babf686f41f63fe04939c1", "target": { "function": "sctp_auth_set_active_key", "file": "net/sctp/auth.c" }, "signature_type": "Function", "deprecated": false, "signature_version": "v1", "id": "CVE-2022-50243-ced9a1bd", "digest": { "function_hash": "260642530473383737724352416597912646283", "length": 588.0 } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@19d636b663e0e92951bba5fced929ca7fd25c552", "target": { "function": "sctp_auth_set_active_key", "file": "net/sctp/auth.c" }, "signature_type": "Function", "deprecated": false, "signature_version": "v1", "id": "CVE-2022-50243-ed7680f5", "digest": { "function_hash": "260642530473383737724352416597912646283", "length": 588.0 } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@19d636b663e0e92951bba5fced929ca7fd25c552", "target": { "function": "sctp_auth_set_key", "file": "net/sctp/auth.c" }, "signature_type": "Function", "deprecated": false, "signature_version": "v1", "id": "CVE-2022-50243-f386daa5", "digest": { "function_hash": "65183161759657524099937178786571949990", "length": 1009.0 } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@022152aaebe116a25c39818a07e175a8cd3c1e11", "target": { "function": "sctp_auth_set_key", "file": "net/sctp/auth.c" }, "signature_type": "Function", "deprecated": false, "signature_version": "v1", "id": "CVE-2022-50243-fa3f294f", "digest": { "function_hash": "65183161759657524099937178786571949990", "length": 1009.0 } } ]