CVE-2022-49957
kcm: fix strp_init() order and cleanup
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 4.14.293, 4.10
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: kcm: fix strp_init() order and cleanup strp_init() is called just a few lines above this csk->sk_user_data check, it also initializes strp->work etc., therefore, it is unnecessary to call strp_done() to cancel the freshly initialized work. And if sk_user_data is already used by KCM, psock->strp should not be touched, particularly strp->work state, so we need to move strp_init() after the csk->sk_user_data check. This also makes a lockdep warning reported by syzbot go away.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From 4.14.22 · fixed in 4.14.293; From 4.9.84 · fixed in 4.10; From 4.9.100 · fixed in 4.10
- Linux Linux
4.15
References 7
git.kernel.org
- stable/c/473f394953216614087f4179e55cdf0cf616a13b
- stable/c/a8a0c321319ad64a5427d6172cd9c23b4d6ca1e8
- stable/c/0946ff31d1a8778787bf6708beb20f38715267cc
- stable/c/1b6666964ca1de93a7bf06e122bcf3616dbd33a9
- stable/c/55fb8c3baa8071c5d533a9ad48624e44e2a04ef5
- stable/c/f865976baa85915c7672f351b74d5974b93215f6
- stable/c/8fc29ff3910f3af08a7c40a75d436b5720efe2bf