In the Linux kernel, the following vulnerability has been resolved:
net: fix UAF issue in nfqnlnfhookdrop() when opsinit() failed
When the opsinit() interface is invoked to initialize the net, but ops->init() fails, data is released. However, the ptr pointer in net->gen is invalid. In this case, when nfqnlnfhookdrop() is invoked to release the net, invalid address access occurs.
The process is as follows: setupnet() opsinit() data = kzalloc(...) ---> alloc "data" netassigngeneric() ---> assign "date" to ptr in net->gen ... ops->init() ---> failed ... kfree(data); ---> ptr in net->gen is invalid ... opsexitlist() ... nfqnlnfhookdrop() *q = nfnlqueue_pernet(net) ---> q is invalid
The following is the Call Trace information: BUG: KASAN: use-after-free in nfqnlnfhookdrop+0x264/0x280 Read of size 8 at addr ffff88810396b240 by task ip/15855 Call Trace: <TASK> dumpstacklvl+0x8e/0xd1 printreport+0x155/0x454 kasanreport+0xba/0x1f0 nfqnlnfhookdrop+0x264/0x280 nfqueuenfhookdrop+0x8b/0x1b0 _nfunregisternethook+0x1ae/0x5a0 nfunregisternethooks+0xde/0x130 opsexitlist+0xb0/0x170 setupnet+0x7ac/0xbd0 copynetns+0x2e6/0x6b0 createnewnamespaces+0x382/0xa50 unsharensproxynamespaces+0xa6/0x1c0 ksysunshare+0x3a4/0x7e0 _x64sysunshare+0x2d/0x40 dosyscall64+0x35/0x80 entrySYSCALL64afterhwframe+0x46/0xb0 </TASK>
Allocated by task 15855: kasansavestack+0x1e/0x40 kasansettrack+0x21/0x30 _kasankmalloc+0xa1/0xb0 _kmalloc+0x49/0xb0 opsinit+0xe7/0x410 setupnet+0x5aa/0xbd0 copynetns+0x2e6/0x6b0 createnewnamespaces+0x382/0xa50 unsharensproxynamespaces+0xa6/0x1c0 ksysunshare+0x3a4/0x7e0 _x64sysunshare+0x2d/0x40 dosyscall64+0x35/0x80 entrySYSCALL64after_hwframe+0x46/0xb0
Freed by task 15855: kasansavestack+0x1e/0x40 kasansettrack+0x21/0x30 kasansavefreeinfo+0x2a/0x40 __kasanslabfree+0x155/0x1b0 slabfreefreelisthook+0x11b/0x220 _kmemcachefree+0xa4/0x360 opsinit+0xb9/0x410 setupnet+0x5aa/0xbd0 copynetns+0x2e6/0x6b0 createnewnamespaces+0x382/0xa50 unsharensproxynamespaces+0xa6/0x1c0 ksysunshare+0x3a4/0x7e0 _x64sysunshare+0x2d/0x40 dosyscall64+0x35/0x80 entrySYSCALL64after_hwframe+0x46/0xb0
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50780.json",
"cna_assigner": "Linux"
}