CVE-2022-49390

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

macsec: fix UAF bug for real_dev

Create a new macsec device but not get reference to real_dev. That can

not ensure that real_dev is freed after macsec. That will trigger the

UAF bug for real_dev as following:

==================================================================

BUG: KASAN: use-after-free in macsec_get_iflink+0x5f/0x70 drivers/net/macsec.c:3662

Call Trace:

...

macsec_get_iflink+0x5f/0x70 drivers/net/macsec.c:3662

dev_get_iflink+0x73/0xe0 net/core/dev.c:637

default_operstate net/core/link_watch.c:42 [inline]

rfc2863_policy+0x233/0x2d0 net/core/link_watch.c:54

linkwatch_do_dev+0x2a/0x150 net/core/link_watch.c:161

Allocated by task 22209:

...

alloc_netdev_mqs+0x98/0x1100 net/core/dev.c:10549

rtnl_create_link+0x9d7/0xc00 net/core/rtnetlink.c:3235

veth_newlink+0x20e/0xa90 drivers/net/veth.c:1748

Freed by task 8:

...

kfree+0xd6/0x4d0 mm/slub.c:4552

kvfree+0x42/0x50 mm/util.c:615

device_release

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References