CVE-2022-50259

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf, sockmap: fix race in sock_map_free()

sock_map_free() calls release_sock(sk) without owning a reference

on the socket. This can cause use-after-free as syzbot found [1]

Jakub Sitnicki already took care of a similar issue

in sock_hash_free() in commit 75e68e5bf2c7 ("bpf, sockhash:

Synchronize delete from bucket list on map free")

[1]

refcount_t: decrement hit 0; leaking memory.

WARNING: CPU: 0 PID: 3785 at lib/refcount.c:31 refcount_warn_saturate+0x17c/0x1a0 lib/refcount.c:31

Modules linked in:

CPU: 0 PID: 3785 Comm: kworker/u4:6 Not tainted 6.1.0-rc7-syzkaller-00103-gef4d3ea40565 #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022

Workqueue: events_unbound bpf_map_free_deferred

RIP: 0010:refcount_warn_saturate+0x17c/0x1a0 lib/refcount.c:31

Code: 68 8b 31 c0 e8 75 71 15 fd 0f 0b e9 64 ff ff ff e8 d9 6e 4e fd c6 05 62 9c 3d 0a 01 48 c7 c7 80 bb 68 8b 31 c0 e8 54 71 15 fd <

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References