| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2022-48786: vsock: remove vsock from connected table when connect is interrupted by a signal |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| vsock: remove vsock from connected table when connect is interrupted by a signal |
| |
| vsock_connect() expects that the socket could already be in the |
| TCP_ESTABLISHED state when the connecting task wakes up with a signal |
| pending. If this happens the socket will be in the connected table, and |
| it is not removed when the socket state is reset. In this situation it's |
| common for the process to retry connect(), and if the connection is |
| successful the socket will be added to the connected table a second |
| time, corrupting the list. |
| |
| Prevent this by calling vsock_remove_connected() if a signal is received |
| while waiting for a connection. This is harmless if the socket is not in |
| the connected table, and if it is in the table then removing it will |
| prevent list corruption from a double add. |
| |
| Note for backporting: this patch requires d5afa82c977e ("vsock: correct |
| removal of socket from the list"), which is in all current stable trees |
| except 4.9.y. |
| |
| The Linux kernel CVE team has assigned CVE-2022-48786 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 3.9 with commit d021c344051af91f42c5ba9fdedc176740cbd238 and fixed in 4.9.303 with commit 0bb88f3f7e8d506f3efe46d694964117e20efbfc |
| Issue introduced in 3.9 with commit d021c344051af91f42c5ba9fdedc176740cbd238 and fixed in 4.14.268 with commit e3b3939fd137aab6d00d54bee0ee9244b286a608 |
| Issue introduced in 3.9 with commit d021c344051af91f42c5ba9fdedc176740cbd238 and fixed in 4.19.231 with commit 2910bcb9f67551a45397735e47b6d456eb8cd549 |
| Issue introduced in 3.9 with commit d021c344051af91f42c5ba9fdedc176740cbd238 and fixed in 5.4.181 with commit 5f326fe2aef411a6575628f92bd861463ea91df7 |
| Issue introduced in 3.9 with commit d021c344051af91f42c5ba9fdedc176740cbd238 and fixed in 5.10.102 with commit 87cd1bbd6677411e17369cd4b7389ab1e1fdba44 |
| Issue introduced in 3.9 with commit d021c344051af91f42c5ba9fdedc176740cbd238 and fixed in 5.15.25 with commit 787468ee7a435777521d33399d012fd591ae2f94 |
| Issue introduced in 3.9 with commit d021c344051af91f42c5ba9fdedc176740cbd238 and fixed in 5.16.11 with commit addd62a8cb6fa90aa322365c62487da61f6baab8 |
| Issue introduced in 3.9 with commit d021c344051af91f42c5ba9fdedc176740cbd238 and fixed in 5.17 with commit b9208492fcaecff8f43915529ae34b3bcb03877c |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2022-48786 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| net/vmw_vsock/af_vsock.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/0bb88f3f7e8d506f3efe46d694964117e20efbfc |
| https://git.kernel.org/stable/c/e3b3939fd137aab6d00d54bee0ee9244b286a608 |
| https://git.kernel.org/stable/c/2910bcb9f67551a45397735e47b6d456eb8cd549 |
| https://git.kernel.org/stable/c/5f326fe2aef411a6575628f92bd861463ea91df7 |
| https://git.kernel.org/stable/c/87cd1bbd6677411e17369cd4b7389ab1e1fdba44 |
| https://git.kernel.org/stable/c/787468ee7a435777521d33399d012fd591ae2f94 |
| https://git.kernel.org/stable/c/addd62a8cb6fa90aa322365c62487da61f6baab8 |
| https://git.kernel.org/stable/c/b9208492fcaecff8f43915529ae34b3bcb03877c |
