CVE-2022-48970

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

af_unix: Get user_ns from in_skb in unix_diag_get_exact().

Wei Chen reported a NULL deref in sk_user_ns() [0][1], and Paolo diagnosed

the root cause: in unix_diag_get_exact(), the newly allocated skb does not

have sk. [2]

We must get the user_ns from the NETLINK_CB(in_skb).sk and pass it to

sk_diag_fill().

[0]:

BUG: kernel NULL pointer dereference, address: 0000000000000270

#PF: supervisor read access in kernel mode

#PF: error_code(0x0000) - not-present page

PGD 12bbce067 P4D 12bbce067 PUD 12bc40067 PMD 0

Oops: 0000 [#1] PREEMPT SMP

CPU: 0 PID: 27942 Comm: syz-executor.0 Not tainted 6.1.0-rc5-next-20221118 #2

Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS

rel-1.13.0-48-gd9c812dda519-prebuilt.qemu.org 04/01/2014

RIP: 0010:sk_user_ns include/net/sock.h:920 [inline]

RIP: 0010:sk_diag_dump_uid net/unix/diag.c:119 [inline]

RIP: 0010:sk_diag_fill+0x77d/0x890 net/unix/diag.c:170

Code: 89 ef e8 66 d4 2d fd c7

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References