CVE-2022-50280

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

pnode: terminate at peers of source

The propagate_mnt() function handles mount propagation when creating

mounts and propagates the source mount tree @source_mnt to all

applicable nodes of the destination propagation mount tree headed by

@dest_mnt.

Unfortunately it contains a bug where it fails to terminate at peers of

@source_mnt when looking up copies of the source mount that become

masters for copies of the source mount tree mounted on top of slaves in

the destination propagation tree causing a NULL dereference.

Once the mechanics of the bug are understood it's easy to trigger.

Because of unprivileged user namespaces it is available to unprivileged

users.

While fixing this bug we've gotten confused multiple times due to

unclear terminology or missing concepts. So let's start this with some

clarifications:

* The terms "master" or "peer" denote a shared mount. A shared mount

belongs to a peer group.

* A peer g

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References