CVE-2022-49093

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

skbuff: fix coalescing for page_pool fragment recycling

Fix a use-after-free when using page_pool with page fragments. We

encountered this problem during normal RX in the hns3 driver:

(1) Initially we have three descriptors in the RX queue. The first one

allocates PAGE1 through page_pool, and the other two allocate one

half of PAGE2 each. Page references look like this:

RX_BD1 _______ PAGE1

RX_BD2 _______ PAGE2

RX_BD3 _________/

(2) Handle RX on the first descriptor. Allocate SKB1, eventually added

to the receive queue by tcp_queue_rcv().

(3) Handle RX on the second descriptor. Allocate SKB2 and pass it to

netif_receive_skb():

netif_receive_skb(SKB2)

ip_rcv(SKB2)

SKB3 = skb_clone(SKB2)

SKB2 and SKB3 share a reference to PAGE2 through

skb_shinfo()->dataref. The other ref to PAGE2 is still held by

RX_BD3:

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References