| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2022-49664: tipc: move bc link creation back to tipc_node_create |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| tipc: move bc link creation back to tipc_node_create |
| |
| Shuang Li reported a NULL pointer dereference crash: |
| |
| [] BUG: kernel NULL pointer dereference, address: 0000000000000068 |
| [] RIP: 0010:tipc_link_is_up+0x5/0x10 [tipc] |
| [] Call Trace: |
| [] <IRQ> |
| [] tipc_bcast_rcv+0xa2/0x190 [tipc] |
| [] tipc_node_bc_rcv+0x8b/0x200 [tipc] |
| [] tipc_rcv+0x3af/0x5b0 [tipc] |
| [] tipc_udp_recv+0xc7/0x1e0 [tipc] |
| |
| It was caused by the 'l' passed into tipc_bcast_rcv() is NULL. When it |
| creates a node in tipc_node_check_dest(), after inserting the new node |
| into hashtable in tipc_node_create(), it creates the bc link. However, |
| there is a gap between this insert and bc link creation, a bc packet |
| may come in and get the node from the hashtable then try to dereference |
| its bc link, which is NULL. |
| |
| This patch is to fix it by moving the bc link creation before inserting |
| into the hashtable. |
| |
| Note that for a preliminary node becoming "real", the bc link creation |
| should also be called before it's rehashed, as we don't create it for |
| preliminary nodes. |
| |
| The Linux kernel CVE team has assigned CVE-2022-49664 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 5.5 with commit 4cbf8ac2fe5a0846508fe02b95a5de1a90fa73f4 and fixed in 5.10.129 with commit 456bc338871c4a52117dd5ef29cce3745456d248 |
| Issue introduced in 5.5 with commit 4cbf8ac2fe5a0846508fe02b95a5de1a90fa73f4 and fixed in 5.15.53 with commit 35fcb2ba35b4d9b592b558c3bcc6e0d90e213588 |
| Issue introduced in 5.5 with commit 4cbf8ac2fe5a0846508fe02b95a5de1a90fa73f4 and fixed in 5.18.10 with commit e52910e671f58c619e33dac476b11b35e2d3ab6f |
| Issue introduced in 5.5 with commit 4cbf8ac2fe5a0846508fe02b95a5de1a90fa73f4 and fixed in 5.19 with commit cb8092d70a6f5f01ec1490fce4d35efed3ed996c |
| Issue introduced in 5.4.287 with commit 0b8f0026bbd4df1688e1726026476e60762daf2a |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2022-49664 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| net/tipc/node.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/456bc338871c4a52117dd5ef29cce3745456d248 |
| https://git.kernel.org/stable/c/35fcb2ba35b4d9b592b558c3bcc6e0d90e213588 |
| https://git.kernel.org/stable/c/e52910e671f58c619e33dac476b11b35e2d3ab6f |
| https://git.kernel.org/stable/c/cb8092d70a6f5f01ec1490fce4d35efed3ed996c |
