CVE-2022-49667

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: bonding: fix use-after-free after 802.3ad slave unbind

commit 0622cab0341c ("bonding: fix 802.3ad aggregator reselection"),

resolve case, when there is several aggregation groups in the same bond.

bond_3ad_unbind_slave will invalidate (clear) aggregator when

__agg_active_ports return zero. So, ad_clear_agg can be executed even, when

num_of_ports!=0. Than bond_3ad_unbind_slave can be executed again for,

previously cleared aggregator. NOTE: at this time bond_3ad_unbind_slave

will not update slave ports list, because lag_ports==NULL. So, here we

got slave ports, pointing to freed aggregator memory.

Fix with checking actual number of ports in group (as was before

commit 0622cab0341c ("bonding: fix 802.3ad aggregator reselection") ),

before ad_clear_agg().

The KASAN logs are as follows:

[ 767.617392] ==================================================================

[ 767.630776] BUG: KASAN: use-after-free in bo

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References