CVE-2022-50310

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ip6mr: fix UAF issue in ip6mr_sk_done() when addrconf_init_net() failed

If the initialization fails in calling addrconf_init_net(), devconf_all is

the pointer that has been released. Then ip6mr_sk_done() is called to

release the net, accessing devconf->mc_forwarding directly causes invalid

pointer access.

The process is as follows:

setup_net()

ops_init()

addrconf_init_net()

all = kmemdup(...) ---> alloc "all"

...

net->ipv6.devconf_all = all;

__addrconf_sysctl_register() ---> failed

...

kfree(all); ---> ipv6.devconf_all invalid

...

ops_exit_list()

...

ip6mr_sk_done()

devconf = net->ipv6.devconf_all;

//devconf is invalid pointer

if (!devconf || !atomic_read(&devconf->mc_forwarding))

The following is the Call Trace information:

BUG: KASAN: use-after-free in ip6mr_sk_done+0x112/0x3a0

Read of size 4 at addr ffff888075508e88 by task ip/14554

Call Trace:

<TASK>

dum

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References