Bug 1195306 (CVE-2022-24122)

Summary:	VUL-0: CVE-2022-24122: kernel-source-rt,kernel-source,kernel-source-azure: use-after-free of user namespace on shm and mqueue destruction due to refcount problems
Product:	[Novell Products] SUSE Security Incidents	Reporter:	Marcus Meissner <meissner>
Component:	Incidents	Assignee:	Security Team bot <security-team>
Status:	RESOLVED FIXED	QA Contact:	Security Team bot <security-team>
Severity:	Major
Priority:	P3 - Medium	CC:	bpetkov, carlos.lopez, jack, mkoutny, smash_bz
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/322165/
Whiteboard:	CVSSv3.1:SUSE:CVE-2022-24122:8.4:(AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---
Bug Depends on:
Bug Blocks:	1196028

Description Marcus Meissner 2022-01-30 10:32:15 UTC

CVE-2022-24122

kernel/ucount.c in the Linux kernel 5.14 through 5.16.4, when unprivileged user
namespaces are enabled, allows a use-after-free and privilege escalation because
a ucounts object can outlive its namespace.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-24122
http://seclists.org/oss-sec/2022/q1/104
https://www.openwall.com/lists/oss-security/2022/01/29/1
http://www.cvedetails.com/cve/CVE-2022-24122/
https://github.com/torvalds/linux/commit/f9d87929d451d3e649699d0f1d74f71f77ad38f5
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24122
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f9d87929d451d3e649699d0f1d74f71f77ad38f5

Comment 1 Marcus Meissner 2022-01-30 10:33:05 UTC

5.14 -> is 15-sp4 and tumbleweed only.

Comment 3 Jan Kara 2022-01-31 12:18:10 UTC

My involvement with ucounts was only because fanotify / inotify use them to track number of watches etc. But I guess that's as good as it gets :). I'll take care of the bug.

Comment 4 Jan Kara 2022-01-31 12:24:40 UTC

Pushed the fix to SLE15-SP4 branch. All should be done from my side, reassigning back to security team.

Comment 11 Carlos López 2022-06-09 09:24:05 UTC

Done, closing.