CVE-2022-49456

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bonding: fix missed rcu protection

When removing the rcu_read_lock in bond_ethtool_get_ts_info() as

discussed [1], I didn't notice it could be called via setsockopt,

which doesn't hold rcu lock, as syzbot pointed:

stack backtrace:

CPU: 0 PID: 3599 Comm: syz-executor317 Not tainted 5.18.0-rc5-syzkaller-01392-g01f4685797a5 #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011

Call Trace:

<TASK>

__dump_stack lib/dump_stack.c:88 [inline]

dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106

bond_option_active_slave_get_rcu include/net/bonding.h:353 [inline]

bond_ethtool_get_ts_info+0x32c/0x3a0 drivers/net/bonding/bond_main.c:5595

__ethtool_get_ts_info+0x173/0x240 net/ethtool/common.c:554

ethtool_get_phc_vclocks+0x99/0x110 net/ethtool/common.c:568

sock_timestamping_bind_phc net/core/sock.c:869 [inline]

sock_set_timestamping+0x3a3/0x7e0 net/core/sock.c:916

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References