cve/published/2022/CVE-2022-49256.mbox

From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: <linux-cve-announce@vger.kernel.org>
Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
Subject: CVE-2022-49256: watch_queue: Actually free the watch

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

watch_queue: Actually free the watch

free_watch() does everything barring actually freeing the watch object.  Fix
this by adding the missing kfree.

kmemleak produces a report something like the following.  Note that as an
address can be seen in the first word, the watch would appear to have gone
through call_rcu().

BUG: memory leak
unreferenced object 0xffff88810ce4a200 (size 96):
  comm "syz-executor352", pid 3605, jiffies 4294947473 (age 13.720s)
  hex dump (first 32 bytes):
    e0 82 48 0d 81 88 ff ff 00 00 00 00 00 00 00 00  ..H.............
    80 a2 e4 0c 81 88 ff ff 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff8214e6cc>] kmalloc include/linux/slab.h:581 [inline]
    [<ffffffff8214e6cc>] kzalloc include/linux/slab.h:714 [inline]
    [<ffffffff8214e6cc>] keyctl_watch_key+0xec/0x2e0 security/keys/keyctl.c:1800
    [<ffffffff8214ec84>] __do_sys_keyctl+0x3c4/0x490 security/keys/keyctl.c:2016
    [<ffffffff84493a25>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    [<ffffffff84493a25>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
    [<ffffffff84600068>] entry_SYSCALL_64_after_hwframe+0x44/0xae

The Linux kernel CVE team has assigned CVE-2022-49256 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.8 with commit c73be61cede5882f9605a852414db559c0ebedfd and fixed in 5.10.110 with commit 9d92be1a09fbb3dd65600dbfe7eedb40e7228e4b
	Issue introduced in 5.8 with commit c73be61cede5882f9605a852414db559c0ebedfd and fixed in 5.15.33 with commit f69aecb49968e14196366bbe896eab0a904229f5
	Issue introduced in 5.8 with commit c73be61cede5882f9605a852414db559c0ebedfd and fixed in 5.16.19 with commit 7e8c9b0df07a77f0d072603b8ced2677e30e1893
	Issue introduced in 5.8 with commit c73be61cede5882f9605a852414db559c0ebedfd and fixed in 5.17.2 with commit 31824613a42aacdcbeb325bf07a1c8247a11ebe2
	Issue introduced in 5.8 with commit c73be61cede5882f9605a852414db559c0ebedfd and fixed in 5.18 with commit 3d8dcf278b1ee1eff1e90be848fa2237db4c07a7

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-49256
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	kernel/watch_queue.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/9d92be1a09fbb3dd65600dbfe7eedb40e7228e4b
	https://git.kernel.org/stable/c/f69aecb49968e14196366bbe896eab0a904229f5
	https://git.kernel.org/stable/c/7e8c9b0df07a77f0d072603b8ced2677e30e1893
	https://git.kernel.org/stable/c/31824613a42aacdcbeb325bf07a1c8247a11ebe2
	https://git.kernel.org/stable/c/3d8dcf278b1ee1eff1e90be848fa2237db4c07a7