Bug 1195306 – VUL-0: CVE-2022-24122: kernel-source-rt,kernel-source,kernel-source-azure: use-after-free of user namespace on shm and mqueue destruction due to refcount problems

Bug 1195306 - (CVE-2022-24122) VUL-0: CVE-2022-24122: kernel-source-rt,kernel-source,kernel-source-azure: use-after-free of user namespace on shm and mqueue destruction due to refcount problems

(CVE-2022-24122)
Summary:	VUL-0: CVE-2022-24122: kernel-source-rt,kernel-source,kernel-source-azure: us...

Status:	RESOLVED FIXED

Classification:	Novell Products
Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents
Version:	unspecified
Hardware:	Other Other

Priority:	P3 - Medium Severity: Major
Target Milestone:	---
Assigned To:	Security Team bot
QA Contact:	Security Team bot

URL:	https://smash.suse.de/issue/322165/
Whiteboard:	CVSSv3.1:SUSE:CVE-2022-24122:8.4:(AV:...
Keywords:

Depends on:
Blocks:	1196028
	Show dependency tree / graph

Create test case

Clone This Bug

Reported:	2022-01-30 10:32 UTC by Marcus Meissner
Modified:	2023-01-18 17:25 UTC (History)
CC List:	5 users (show)

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Marcus Meissner 2022-01-30 10:32:15 UTC

CVE-2022-24122

kernel/ucount.c in the Linux kernel 5.14 through 5.16.4, when unprivileged user
namespaces are enabled, allows a use-after-free and privilege escalation because
a ucounts object can outlive its namespace.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-24122
http://seclists.org/oss-sec/2022/q1/104
https://www.openwall.com/lists/oss-security/2022/01/29/1
http://www.cvedetails.com/cve/CVE-2022-24122/
https://github.com/torvalds/linux/commit/f9d87929d451d3e649699d0f1d74f71f77ad38f5
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24122
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f9d87929d451d3e649699d0f1d74f71f77ad38f5

Comment 1 Marcus Meissner 2022-01-30 10:33:05 UTC

5.14 -> is 15-sp4 and tumbleweed only.

Comment 3 Jan Kara 2022-01-31 12:18:10 UTC

My involvement with ucounts was only because fanotify / inotify use them to track number of watches etc. But I guess that's as good as it gets :). I'll take care of the bug.

Comment 4 Jan Kara 2022-01-31 12:24:40 UTC

Pushed the fix to SLE15-SP4 branch. All should be done from my side, reassigning back to security team.

Comment 11 Carlos López 2022-06-09 09:24:05 UTC

Done, closing.