linux-cve-announce - CVE-2022-48861: vdpa: fix use-after-free on vp_vdpa

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2024071628-CVE-2022-48861-440e@gregkh>
Date: Tue, 16 Jul 2024 14:27:46 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2022-48861: vdpa: fix use-after-free on vp_vdpa_remove

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

vdpa: fix use-after-free on vp_vdpa_remove

When vp_vdpa driver is unbind, vp_vdpa is freed in vdpa_unregister_device
and then vp_vdpa->mdev.pci_dev is dereferenced in vp_modern_remove,
triggering use-after-free.

Call Trace of unbinding driver free vp_vdpa :
do_syscall_64
  vfs_write
    kernfs_fop_write_iter
      device_release_driver_internal
        pci_device_remove
          vp_vdpa_remove
            vdpa_unregister_device
              kobject_release
                device_release
                  kfree

Call Trace of dereference vp_vdpa->mdev.pci_dev:
vp_modern_remove
  pci_release_selected_regions
    pci_release_region
      pci_resource_len
        pci_resource_end
          (dev)->resource[(bar)].end

The Linux kernel CVE team has assigned CVE-2022-48861 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.13 with commit 64b9f64f80a6 and fixed in 5.15.29 with commit 4b1743bc715a
	Issue introduced in 5.13 with commit 64b9f64f80a6 and fixed in 5.16.15 with commit dc54ba9932ae
	Issue introduced in 5.13 with commit 64b9f64f80a6 and fixed in 5.17 with commit eb057b44dbe3

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-48861
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/vdpa/virtio_pci/vp_vdpa.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/4b1743bc715a3691a63ac21b349079b07bf1b19e
	https://git.kernel.org/stable/c/dc54ba9932aeaaa1a21fe214af1f446593a78274
	https://git.kernel.org/stable/c/eb057b44dbe35ae14527830236a92f51de8f9184