linux-cve-announce - CVE-2022-49690: net/tls: fix tls_sk_proto

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025022627-CVE-2022-49690-2222@gregkh>
Date: Wed, 26 Feb 2025 03:24:13 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2022-49690: net/tls: fix tls_sk_proto_close executed repeatedly

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net/tls: fix tls_sk_proto_close executed repeatedly

After setting the sock ktls, update ctx->sk_proto to sock->sk_prot by
tls_update(), so now ctx->sk_proto->close is tls_sk_proto_close(). When
close the sock, tls_sk_proto_close() is called for sock->sk_prot->close
is tls_sk_proto_close(). But ctx->sk_proto->close() will be executed later
in tls_sk_proto_close(). Thus tls_sk_proto_close() executed repeatedly
occurred. That will trigger the following bug.

=================================================================
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
RIP: 0010:tls_sk_proto_close+0xd8/0xaf0 net/tls/tls_main.c:306
Call Trace:
 <TASK>
 tls_sk_proto_close+0x356/0xaf0 net/tls/tls_main.c:329
 inet_release+0x12e/0x280 net/ipv4/af_inet.c:428
 __sock_release+0xcd/0x280 net/socket.c:650
 sock_close+0x18/0x20 net/socket.c:1365

Updating a proto which is same with sock->sk_prot is incorrect. Add proto
and sock->sk_prot equality check at the head of tls_update() to fix it.

The Linux kernel CVE team has assigned CVE-2022-49690 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.3 with commit 95fa145479fbc0a0c1fd3274ceb42ec03c042a4a and fixed in 5.4.202 with commit 05c6c36c79311d9a00a79f88647f83a7cf009624
	Issue introduced in 5.3 with commit 95fa145479fbc0a0c1fd3274ceb42ec03c042a4a and fixed in 5.10.127 with commit e82376b632473790781a182b10823a4b5dbf6606
	Issue introduced in 5.3 with commit 95fa145479fbc0a0c1fd3274ceb42ec03c042a4a and fixed in 5.15.51 with commit be64f54a0db2dbf399f3bca45458d06c833641f0
	Issue introduced in 5.3 with commit 95fa145479fbc0a0c1fd3274ceb42ec03c042a4a and fixed in 5.18.8 with commit 9b95ee8990d9b4b6086c309632b9d0d576833abe
	Issue introduced in 5.3 with commit 95fa145479fbc0a0c1fd3274ceb42ec03c042a4a and fixed in 5.19 with commit 69135c572d1f84261a6de2a1268513a7e71753e2

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-49690
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/tls/tls_main.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/05c6c36c79311d9a00a79f88647f83a7cf009624
	https://git.kernel.org/stable/c/e82376b632473790781a182b10823a4b5dbf6606
	https://git.kernel.org/stable/c/be64f54a0db2dbf399f3bca45458d06c833641f0
	https://git.kernel.org/stable/c/9b95ee8990d9b4b6086c309632b9d0d576833abe
	https://git.kernel.org/stable/c/69135c572d1f84261a6de2a1268513a7e71753e2