CVE-2022-50661

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

seccomp: Move copy_seccomp() to no failure path.

Our syzbot instance reported memory leaks in do_seccomp() [0], similar

to the report [1]. It shows that we miss freeing struct seccomp_filter

and some objects included in it.

We can reproduce the issue with the program below [2] which calls one

seccomp() and two clone() syscalls.

The first clone()d child exits earlier than its parent and sends a

signal to kill it during the second clone(), more precisely before the

fatal_signal_pending() test in copy_process(). When the parent receives

the signal, it has to destroy the embryonic process and return -EINTR to

user space. In the failure path, we have to call seccomp_filter_release()

to decrement the filter's refcount.

Initially, we called it in free_task() called from the failure path, but

the commit 3a15fb6ed92c ("seccomp: release filter after task is fully

dead") moved it to release_task() to notify user space as

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References