CVE-2022-50335

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

9p: set req refcount to zero to avoid uninitialized usage

When a new request is allocated, the refcount will be zero if it is

reused, but if the request is newly allocated from slab, it is not fully

initialized before being added to idr.

If the p9_read_work got a response before the refcount initiated. It will

use a uninitialized req, which will result in a bad request data struct.

Here is the logs from syzbot.

Corrupted memory at 0xffff88807eade00b [ 0xff 0x07 0x00 0x00 0x00 0x00

0x00 0x00 . . . . . . . . ] (in kfence-#110):

p9_fcall_fini net/9p/client.c:248 [inline]

p9_req_put net/9p/client.c:396 [inline]

p9_req_put+0x208/0x250 net/9p/client.c:390

p9_client_walk+0x247/0x540 net/9p/client.c:1165

clone_fid fs/9p/fid.h:21 [inline]

v9fs_fid_xattr_set+0xe4/0x2b0 fs/9p/xattr.c:118

v9fs_xattr_set fs/9p/xattr.c:100 [inline]

v9fs_xattr_handler_set+0x6f/0x120 fs/9p/xattr.c:159

__vfs_setxattr+0x119/0x180 fs/xattr.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References