linux-cve-announce - CVE-2022-49958: net/sched: fix netdevice reference leaks in attach_default

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025061812-CVE-2022-49958-35f5@gregkh>
Date: Wed, 18 Jun 2025 13:00:23 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2022-49958: net/sched: fix netdevice reference leaks in attach_default_qdiscs()

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net/sched: fix netdevice reference leaks in attach_default_qdiscs()

In attach_default_qdiscs(), if a dev has multiple queues and queue 0 fails
to attach qdisc because there is no memory in attach_one_default_qdisc().
Then dev->qdisc will be noop_qdisc by default. But the other queues may be
able to successfully attach to default qdisc.

In this case, the fallback to noqueue process will be triggered. If the
original attached qdisc is not released and a new one is directly
attached, this will cause netdevice reference leaks.

The following is the bug log:

veth0: default qdisc (fq_codel) fail, fallback to noqueue
unregister_netdevice: waiting for veth0 to become free. Usage count = 32
leaked reference.
 qdisc_alloc+0x12e/0x210
 qdisc_create_dflt+0x62/0x140
 attach_one_default_qdisc.constprop.41+0x44/0x70
 dev_activate+0x128/0x290
 __dev_open+0x12a/0x190
 __dev_change_flags+0x1a2/0x1f0
 dev_change_flags+0x23/0x60
 do_setlink+0x332/0x1150
 __rtnl_newlink+0x52f/0x8e0
 rtnl_newlink+0x43/0x70
 rtnetlink_rcv_msg+0x140/0x3b0
 netlink_rcv_skb+0x50/0x100
 netlink_unicast+0x1bb/0x290
 netlink_sendmsg+0x37c/0x4e0
 sock_sendmsg+0x5f/0x70
 ____sys_sendmsg+0x208/0x280

Fix this bug by clearing any non-noop qdiscs that may have been assigned
before trying to re-attach.

The Linux kernel CVE team has assigned CVE-2022-49958 to this issue.

Affected and fixed versions
===========================

	Issue introduced in 5.8 with commit bf6dba76d278d296b385b436d3ac7de56c190d44 and fixed in 5.10.142 with commit 44dfa645895a56f65461249deb5b81cd16560e2a
	Issue introduced in 5.8 with commit bf6dba76d278d296b385b436d3ac7de56c190d44 and fixed in 5.15.66 with commit a420d587260185407eda9c5766cfa9bdd5c39a56
	Issue introduced in 5.8 with commit bf6dba76d278d296b385b436d3ac7de56c190d44 and fixed in 5.19.8 with commit 0c6c522857151ac00150fd01baeebf231fb7d142
	Issue introduced in 5.8 with commit bf6dba76d278d296b385b436d3ac7de56c190d44 and fixed in 6.0 with commit f612466ebecb12a00d9152344ddda6f6345f04dc

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-49958
will be updated if fixes are backported, please check that for the most
up to date information about this issue.

Affected files
==============

The file(s) affected by this issue are:
	net/sched/sch_generic.c

Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/44dfa645895a56f65461249deb5b81cd16560e2a
	https://git.kernel.org/stable/c/a420d587260185407eda9c5766cfa9bdd5c39a56
	https://git.kernel.org/stable/c/0c6c522857151ac00150fd01baeebf231fb7d142
	https://git.kernel.org/stable/c/f612466ebecb12a00d9152344ddda6f6345f04dc