Bugzilla – Bug 1197246
VUL-0: CVE-2022-0995: kernel: kernel bug in the watch_queue subsystem
Last modified: 2022-06-08 14:00:23 UTC
rh#2063786 The watch_queue event notification subsystem in the kernel has a couple of out of bounds writes that can be triggered by any user. These can be used to overwrite parts of the kernel state, potentially allowing the user to gain privileged access to or panic the system. https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=93ce93587d36493f2f86921fa79921b3cba63fbb References: https://bugzilla.redhat.com/show_bug.cgi?id=2063786 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-0995
Something interesting for filesystem team?
Thanks for the report. From an initial skim it looks as though this is relevant to SLE15-SP4 / Tumbleweed which carry CONFIG_WATCH_QUEUE=y with c73be61cede5 ("pipe: Add general notification queue support").
I've prepared the 15-SP4 backports for this and will submit when finished with testing.
The changes are queued for SLE15-SP4-GA . I had to make one minor change to avoid kABI breakage from the sizeof(type_filter) reduction: --- a/include/linux/watch_queue.h +++ b/include/linux/watch_queue.h @@ -28,7 +28,12 @@ struct watch_type_filter { struct watch_filter { union { struct rcu_head rcu; - unsigned long type_filter[2]; /* Bitmask of accepted types */ + /* Bitmask of accepted types */ +#ifdef __GENKSYMS__ + unsigned long type_filter[2]; +#else + DECLARE_BITMAP(type_filter, WATCH_TYPE__NR); +#endif }; u32 nr_filters; /* Number of filters */ struct watch_type_filter filters[];
Two more watch_queue fixes hit mainline just last week, which I'll also track via this ticket as a follow-up to the previous merge: "Here are fixes for a couple more watch_queue bugs, both found by syzbot: - Fix error cleanup in watch_queue_set_size() where it tries to clean up all the pointers in the page list, even if they've not been allocated yet[1]. Unfortunately, __free_page() doesn't treat a NULL pointer as being "do nothing". A second report[2] looks like it's probably the same bug, but on arm64 rather than x86_64, but there's no reproducer. - Fix a missing kfree in free_watch() to actually free the watch[3]" Link: https://lore.kernel.org/r/000000000000b1807c05daad8f98@google.com/ [1] Link: https://lore.kernel.org/r/000000000000035b9c05daae8a5e@google.com/ [2] Link: https://lore.kernel.org/r/000000000000bc8eaf05dab91c63@google.com/ [3] * 'keys-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs: watch_queue: Actually free the watch watch_queue: Fix NULL dereference in error cleanup
This bug seems to approach a good date for CVE SLA fulfillment [1]. What is its status, please? [1] https://confluence.suse.com/display/KSS/Kernel+Security+Sentinel
(In reply to Petr Mladek from comment #11) > This bug seems to approach a good date for CVE SLA fulfillment [1]. > What is its status, please? Fixes are all merged. I think this ticket can be closed - setting needinfo for security team.
(In reply to David Disseldorp from comment #12) ... > Fixes are all merged. I think this ticket can be closed - setting needinfo > for security team. Transferring...
Done, closing.