NVD Vulnerability Detail

CVE-2022-49017

Summary	In the Linux kernel, the following vulnerability has been resolved: tipc: re-fetch skb cb after tipc_msg_validate As the call trace shows, the original skb was freed in tipc_msg_validate(), and dereferencing the old skb cb would cause an use-after-free crash. BUG: KASAN: use-after-free in tipc_crypto_rcv_complete+0x1835/0x2240 [tipc] Call Trace: <IRQ> tipc_crypto_rcv_complete+0x1835/0x2240 [tipc] tipc_crypto_rcv+0xd32/0x1ec0 [tipc] tipc_rcv+0x744/0x1150 [tipc] ... Allocated by task 47078: kmem_cache_alloc_node+0x158/0x4d0 __alloc_skb+0x1c1/0x270 tipc_buf_acquire+0x1e/0xe0 [tipc] tipc_msg_create+0x33/0x1c0 [tipc] tipc_link_build_proto_msg+0x38a/0x2100 [tipc] tipc_link_timeout+0x8b8/0xef0 [tipc] tipc_node_timeout+0x2a1/0x960 [tipc] call_timer_fn+0x2d/0x1c0 ... Freed by task 47078: tipc_msg_validate+0x7b/0x440 [tipc] tipc_crypto_rcv_complete+0x4b5/0x2240 [tipc] tipc_crypto_rcv+0xd32/0x1ec0 [tipc] tipc_rcv+0x744/0x1150 [tipc] This patch fixes it by re-fetching the skb cb from the new allocated skb after calling tipc_msg_validate().
Publication Date	Oct. 22, 2024, 5:15 a.m.
Registration Date	Oct. 22, 2024, 12:01 p.m.
Last Update	Oct. 25, 2024, 3:36 a.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	https://git.kernel.org/stable/c/a1ba595e35aa3afbe417ff0af353afb9f65559c0	Patch
2	https://git.kernel.org/stable/c/1daec0815655e110c6f206c5e777a4af8168ff58	Patch
3	https://git.kernel.org/stable/c/e128190adb2edfd5042105b5d1ed4553f295f5ef	Patch
4	https://git.kernel.org/stable/c/3067bc61fcfe3081bf4807ce65560f499e895e77	Patch

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-416	解放済みメモリの使用	https://cwe.mitre.org/data/definitions/416.html

JVN Vulnerability Information

Linux の Linux Kernel における解放済みメモリの使用に関する脆弱性

Title	Linux の Linux Kernel における解放済みメモリの使用に関する脆弱性
Summary	Linux の Linux Kernel には、解放済みメモリの使用に関する脆弱性が存在します。
Possible impacts	情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Nov. 28, 2022, midnight
Registration Date	Oct. 29, 2024, 3:52 p.m.
Last Update	Oct. 29, 2024, 3:52 p.m.

Affected System

Linux

Linux Kernel 5.11 以上 5.15.82 未満

Linux Kernel 5.16 以上 6.0.12 未満

Linux Kernel 5.5 以上 5.10.158 未満

Linux Kernel 6.1

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2022-49017	https://www.cve.org/CVERecord?id=CVE-2022-49017
National Vulnerability Database (NVD)
2	CVE-2022-49017	https://nvd.nist.gov/vuln/detail/CVE-2022-49017

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-416	https://cwe.mitre.org/data/definitions/416.html

ベンダー情報

No	Name	URL
Kernel.org git repositories
1	tipc: re-fetch skb cb after tipc_msg_validate (1daec08)	https://git.kernel.org/stable/c/1daec0815655e110c6f206c5e777a4af8168ff58
2	tipc: re-fetch skb cb after tipc_msg_validate (3067bc6)	https://git.kernel.org/stable/c/3067bc61fcfe3081bf4807ce65560f499e895e77
3	tipc: re-fetch skb cb after tipc_msg_validate (a1ba595)	https://git.kernel.org/stable/c/a1ba595e35aa3afbe417ff0af353afb9f65559c0
4	tipc: re-fetch skb cb after tipc_msg_validate (e128190)	https://git.kernel.org/stable/c/e128190adb2edfd5042105b5d1ed4553f295f5ef
Linux Kernel
5	Linux Kernel Archives	https://www.kernel.org

Change Log

No	Changed Details	Date of change
1	[2024年10月29日] 掲載	Oct. 29, 2024, 3:52 p.m.