CVE-2022-50310

In the Linux kernel, the following vulnerability has been resolved:

ip6mr: fix UAF issue in ip6mr_sk_done() when addrconf_init_net() failed

If the initialization fails in calling addrconf_init_net(), devconf_all is

the pointer that has been released. Then ip6mr_sk_done() is called to

release the net, accessing devconf->mc_forwarding directly causes invalid

pointer access.

The process is as follows:

setup_net()

ops_init()

addrconf_init_net()

all = kmemdup(...) ---> alloc "all"

...

net->ipv6.devconf_all = all;

__addrconf_sysctl_register() ---> failed

...

kfree(all); ---> ipv6.devconf_all invalid

...

ops_exit_list()

...

ip6mr_sk_done()

devconf = net->ipv6.devconf_all;

//devconf is invalid pointer

if (!devconf || !atomic_read(&devconf->mc_forwarding))

The following is the Call Trace information:

BUG: KASAN: use-after-free in ip6mr_sk_done+0x112/0x3a0

Read of size 4 at addr ffff888075508e88 by task ip/14554

Call Trace:

<TASK>

dump_stack_lvl+0x8e/0xd1

print_report+0x155/0x454

kasan_report+0xba/0x1f0

kasan_check_range+0x35/0x1b0

ip6mr_sk_done+0x112/0x3a0

rawv6_close+0x48/0x70

inet_release+0x109/0x230

inet6_release+0x4c/0x70

sock_release+0x87/0x1b0

igmp6_net_exit+0x6b/0x170

ops_exit_list+0xb0/0x170

setup_net+0x7ac/0xbd0

copy_net_ns+0x2e6/0x6b0

create_new_namespaces+0x382/0xa50

unshare_nsproxy_namespaces+0xa6/0x1c0

ksys_unshare+0x3a4/0x7e0

__x64_sys_unshare+0x2d/0x40

do_syscall_64+0x35/0x80

entry_SYSCALL_64_after_hwframe+0x46/0xb0

RIP: 0033:0x7f7963322547

</TASK>

Allocated by task 14554:

kasan_save_stack+0x1e/0x40

kasan_set_track+0x21/0x30

__kasan_kmalloc+0xa1/0xb0

__kmalloc_node_track_caller+0x4a/0xb0

kmemdup+0x28/0x60

addrconf_init_net+0x1be/0x840

ops_init+0xa5/0x410

setup_net+0x5aa/0xbd0

copy_net_ns+0x2e6/0x6b0

create_new_namespaces+0x382/0xa50

unshare_nsproxy_namespaces+0xa6/0x1c0

ksys_unshare+0x3a4/0x7e0

__x64_sys_unshare+0x2d/0x40

do_syscall_64+0x35/0x80

entry_SYSCALL_64_after_hwframe+0x46/0xb0

Freed by task 14554:

kasan_save_stack+0x1e/0x40

kasan_set_track+0x21/0x30

kasan_save_free_info+0x2a/0x40

____kasan_slab_free+0x155/0x1b0

slab_free_freelist_hook+0x11b/0x220

__kmem_cache_free+0xa4/0x360

addrconf_init_net+0x623/0x840

ops_init+0xa5/0x410

setup_net+0x5aa/0xbd0

copy_net_ns+0x2e6/0x6b0

create_new_namespaces+0x382/0xa50

unshare_nsproxy_namespaces+0xa6/0x1c0

ksys_unshare+0x3a4/0x7e0

__x64_sys_unshare+0x2d/0x40

do_syscall_64+0x35/0x80

entry_SYSCALL_64_after_hwframe+0x46/0xb0