CVE-2022-49337

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock

When user_dlm_destroy_lock failed, it didn't clean up the flags it set

before exit. For USER_LOCK_IN_TEARDOWN, if this function fails because of

lock is still in used, next time when unlink invokes this function, it

will return succeed, and then unlink will remove inode and dentry if lock

is not in used(file closed), but the dlm lock is still linked in dlm lock

resource, then when bast come in, it will trigger a panic due to

user-after-free. See the following panic call trace. To fix this,

USER_LOCK_IN_TEARDOWN should be reverted if fail. And also error should

be returned if USER_LOCK_IN_TEARDOWN is set to let user know that unlink

fail.

For the case of ocfs2_dlm_unlock failure, besides USER_LOCK_IN_TEARDOWN,

USER_LOCK_BUSY is also required to be cleared. Even though spin lock is

released in between, but USER_LOCK_IN_TEARDOWN is still set, for

USER_LOCK_

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References