Skip to content
Heist/ feed
High

kernfs: fix use-after-free in __kernfs_remove

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: kernfs: fix use-after-free in __kernfs_remove Syzkaller managed to trigger concurrent calls to kernfs_remove_by_name_ns() for the same file resulting in a KASAN detected use-after-free. The race occurs when the root node is freed during kernfs_drain(). To prevent this acquire an additional reference for the root of the tree that is removed before calling __kernfs_remove(). Found by syzkaller with the following reproducer (slab_nomerge is required): syz_mount_image$ext4(0x0, &(0x7f0000000100)='./file0\x00', 0x100000, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/exe\x00', 0x0, 0x0) close(r0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0), 0x408, &(0x7f0000000280)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@mmap}, {@loose}, {@loose}, {@mmap}], [{@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@fsmagic={'fsmagic', 0x3d, 0x10001}}, {@dont_hash}]}}) Sample report: ================================================================== BUG: KASAN: use-after-free in kernfs_type include/linux/kernfs.h:335 [inline] BUG: KASAN: use-after-free in kernfs_leftmost_descendant fs/kernfs/dir.c:1261 [inline] BUG: KASAN: use-after-free in __kernfs_remove.part.0+0x843/0x960 fs/kernfs/dir.c:1369 Read of size 2 at addr ffff8880088807f0 by task syz-executor.2/857 CPU: 0 PID:

Announced Source revision 1
Original source ↗

CVE-2022-50432

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2022-50432

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "45a140e587f3d32d8d424ed940dffb61e1739047",
        "lessThan": "4dfd6a477a1525773469feaf3c514b2c0fef76b5",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "45a140e587f3d32d8d424ed940dffb61e1739047",
        "lessThan": "02eb35131050735332658029082f61515b7dfe38",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "45a140e587f3d32d8d424ed940dffb61e1739047",
        "lessThan": "028cf780743eea79abffa7206b9dcfc080ad3546",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "45a140e587f3d32d8d424ed940dffb61e1739047",
        "lessThan": "c78b0dc6fb7fb389d674e491fd376388cdfb1d53",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "45a140e587f3d32d8d424ed940dffb61e1739047",
        "lessThan": "6f72a3977ba9d0e5491a5c01315204272e7f9c44",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "45a140e587f3d32d8d424ed940dffb61e1739047",
        "lessThan": "94d2643df1e70a4c310ebb5e2c493eec33df1a06",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "45a140e587f3d32d8d424ed940dffb61e1739047",
        "lessThan": "af1b57cc39beca203559576b3046094fc9e5eb32",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "45a140e587f3d32d8d424ed940dffb61e1739047",
        "lessThan": "4abc99652812a2ddf932f137515d5c5a04723538",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "fs/kernfs/dir.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "3.14"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "3.14",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "4.9.332",
        "versionType": "semver",
        "lessThanOrEqual": "4.9.*"
      },
      {
        "status": "unaffected",
        "version": "4.14.298",
        "versionType": "semver",
        "lessThanOrEqual": "4.14.*"
      },
      {
        "status": "unaffected",
        "version": "4.19.264",
        "versionType": "semver",
        "lessThanOrEqual": "4.19.*"
      },
      {
        "status": "unaffected",
        "version": "5.4.223",
        "versionType": "semver",
        "lessThanOrEqual": "5.4.*"
      },
      {
        "status": "unaffected",
        "version": "5.10.153",
        "versionType": "semver",
        "lessThanOrEqual": "5.10.*"
      },
      {
        "status": "unaffected",
        "version": "5.15.77",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.0.7",
        "versionType": "semver",
        "lessThanOrEqual": "6.0.*"
      },
      {
        "status": "unaffected",
        "version": "6.1",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "fs/kernfs/dir.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2022-50432

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#30215 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement