cve/published/2022/CVE-2022-49080.mbox

From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: <linux-cve-announce@vger.kernel.org>
Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
Subject: CVE-2022-49080: mm/mempolicy: fix mpol_new leak in shared_policy_replace

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

mm/mempolicy: fix mpol_new leak in shared_policy_replace

If mpol_new is allocated but not used in restart loop, mpol_new will be
freed via mpol_put before returning to the caller.  But refcnt is not
initialized yet, so mpol_put could not do the right things and might
leak the unused mpol_new.  This would happen if mempolicy was updated on
the shared shmem file while the sp->lock has been dropped during the
memory allocation.

This issue could be triggered easily with the below code snippet if
there are many processes doing the below work at the same time:

  shmid = shmget((key_t)5566, 1024 * PAGE_SIZE, 0666|IPC_CREAT);
  shm = shmat(shmid, 0, 0);
  loop many times {
    mbind(shm, 1024 * PAGE_SIZE, MPOL_LOCAL, mask, maxnode, 0);
    mbind(shm + 128 * PAGE_SIZE, 128 * PAGE_SIZE, MPOL_DEFAULT, mask,
          maxnode, 0);
  }

The Linux kernel CVE team has assigned CVE-2022-49080 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 3.8 with commit 42288fe366c4f1ce7522bc9f27d0bc2a81c55264 and fixed in 4.9.311 with commit 8510c2346d9e47a72b7f018a36ef0c39483e53d6
	Issue introduced in 3.8 with commit 42288fe366c4f1ce7522bc9f27d0bc2a81c55264 and fixed in 4.14.276 with commit 5e16dc5378abd749a836daa9ee4ab2c8d2668999
	Issue introduced in 3.8 with commit 42288fe366c4f1ce7522bc9f27d0bc2a81c55264 and fixed in 4.19.238 with commit 39a32f3c06f6d68a530bf9612afa19f50f12e93d
	Issue introduced in 3.8 with commit 42288fe366c4f1ce7522bc9f27d0bc2a81c55264 and fixed in 5.4.189 with commit 25f506273b6ae806fd46bfcb6fdaa5b9ec81a05b
	Issue introduced in 3.8 with commit 42288fe366c4f1ce7522bc9f27d0bc2a81c55264 and fixed in 5.10.111 with commit f7e183b0a7136b6dc9c7b9b2a85a608a8feba894
	Issue introduced in 3.8 with commit 42288fe366c4f1ce7522bc9f27d0bc2a81c55264 and fixed in 5.15.34 with commit 198932a14aeb19a15cf19e51e151d023bc4cd648
	Issue introduced in 3.8 with commit 42288fe366c4f1ce7522bc9f27d0bc2a81c55264 and fixed in 5.16.20 with commit 6e00309ac716fa8225f0cbde2cd9c24f0e74ee21
	Issue introduced in 3.8 with commit 42288fe366c4f1ce7522bc9f27d0bc2a81c55264 and fixed in 5.17.3 with commit fe39ac59dbbf893b73b24e3184161d0bd06d6651
	Issue introduced in 3.8 with commit 42288fe366c4f1ce7522bc9f27d0bc2a81c55264 and fixed in 5.18 with commit 4ad099559b00ac01c3726e5c95dc3108ef47d03e

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-49080
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	mm/mempolicy.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/8510c2346d9e47a72b7f018a36ef0c39483e53d6
	https://git.kernel.org/stable/c/5e16dc5378abd749a836daa9ee4ab2c8d2668999
	https://git.kernel.org/stable/c/39a32f3c06f6d68a530bf9612afa19f50f12e93d
	https://git.kernel.org/stable/c/25f506273b6ae806fd46bfcb6fdaa5b9ec81a05b
	https://git.kernel.org/stable/c/f7e183b0a7136b6dc9c7b9b2a85a608a8feba894
	https://git.kernel.org/stable/c/198932a14aeb19a15cf19e51e151d023bc4cd648
	https://git.kernel.org/stable/c/6e00309ac716fa8225f0cbde2cd9c24f0e74ee21
	https://git.kernel.org/stable/c/fe39ac59dbbf893b73b24e3184161d0bd06d6651
	https://git.kernel.org/stable/c/4ad099559b00ac01c3726e5c95dc3108ef47d03e