CVE-2022-49300

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nbd: fix race between nbd_alloc_config() and module removal

When nbd module is being removing, nbd_alloc_config() may be

called concurrently by nbd_genl_connect(), although try_module_get()

will return false, but nbd_alloc_config() doesn't handle it.

The race may lead to the leak of nbd_config and its related

resources (e.g, recv_workq) and oops in nbd_read_stat() due

to the unload of nbd module as shown below:

BUG: kernel NULL pointer dereference, address: 0000000000000040

Oops: 0000 [#1] SMP PTI

CPU: 5 PID: 13840 Comm: kworker/u17:33 Not tainted 5.14.0+ #1

Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)

Workqueue: knbd16-recv recv_work [nbd]

RIP: 0010:nbd_read_stat.cold+0x130/0x1a4 [nbd]

Call Trace:

recv_work+0x3b/0xb0 [nbd]

process_one_work+0x1ed/0x390

worker_thread+0x4a/0x3d0

kthread+0x12a/0x150

ret_from_fork+0x22/0x30

Fixing it by checking the return value of try_module_get(

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References