CVE-2022-50459

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

scsi: iscsi: iscsi_tcp: Fix null-ptr-deref while calling getpeername()

Fix a NULL pointer crash that occurs when we are freeing the socket at the

same time we access it via sysfs.

The problem is that:

1. iscsi_sw_tcp_conn_get_param() and iscsi_sw_tcp_host_get_param() take

the frwd_lock and do sock_hold() then drop the frwd_lock. sock_hold()

does a get on the "struct sock".

2. iscsi_sw_tcp_release_conn() does sockfd_put() which does the last put

on the "struct socket" and that does __sock_release() which sets the

sock->ops to NULL.

3. iscsi_sw_tcp_conn_get_param() and iscsi_sw_tcp_host_get_param() then

call kernel_getpeername() which accesses the NULL sock->ops.

Above we do a get on the "struct sock", but we needed a get on the "struct

socket". Originally, we just held the frwd_lock the entire time but in

commit bcf3a2953d36 ("scsi: iscsi: iscsi_tcp: Avoid holding spinlock while

calling get

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References