net: bonding: fix use-after-free after 802.3ad slave unbind 漏洞信息(CVE-2022-49667)

一、漏洞 CVE-2022-49667 基础信息

AIGC 神龙大模型
美国国家漏洞数据库 NVD

漏洞标题

内核: bonding: 修复802.3ad从设备解绑定后的释放后使用问题

来源：AIGC 神龙大模型

漏洞描述信息

N/A

来源：AIGC 神龙大模型

CVSS信息

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H

来源：AIGC 神龙大模型

漏洞类别

释放后使用

来源：AIGC 神龙大模型

漏洞标题

net: bonding: fix use-after-free after 802.3ad slave unbind

来源：美国国家漏洞数据库 NVD

漏洞描述信息

In the Linux kernel, the following vulnerability has been resolved: net: bonding: fix use-after-free after 802.3ad slave unbind commit 0622cab0341c ("bonding: fix 802.3ad aggregator reselection"), resolve case, when there is several aggregation groups in the same bond. bond_3ad_unbind_slave will invalidate (clear) aggregator when __agg_active_ports return zero. So, ad_clear_agg can be executed even, when num_of_ports!=0. Than bond_3ad_unbind_slave can be executed again for, previously cleared aggregator. NOTE: at this time bond_3ad_unbind_slave will not update slave ports list, because lag_ports==NULL. So, here we got slave ports, pointing to freed aggregator memory. Fix with checking actual number of ports in group (as was before commit 0622cab0341c ("bonding: fix 802.3ad aggregator reselection") ), before ad_clear_agg(). The KASAN logs are as follows: [ 767.617392] ================================================================== [ 767.630776] BUG: KASAN: use-after-free in bond_3ad_state_machine_handler+0x13dc/0x1470 [ 767.638764] Read of size 2 at addr ffff00011ba9d430 by task kworker/u8:7/767 [ 767.647361] CPU: 3 PID: 767 Comm: kworker/u8:7 Tainted: G O 5.15.11 #15 [ 767.655329] Hardware name: DNI AmazonGo1 A7040 board (DT) [ 767.660760] Workqueue: lacp_1 bond_3ad_state_machine_handler [ 767.666468] Call trace: [ 767.668930] dump_backtrace+0x0/0x2d0 [ 767.672625] show_stack+0x24/0x30 [ 767.675965] dump_stack_lvl+0x68/0x84 [ 767.679659] print_address_description.constprop.0+0x74/0x2b8 [ 767.685451] kasan_report+0x1f0/0x260 [ 767.689148] __asan_load2+0x94/0xd0 [ 767.692667] bond_3ad_state_machine_handler+0x13dc/0x1470

来源：美国国家漏洞数据库 NVD

CVSS信息

N/A

来源：美国国家漏洞数据库 NVD

漏洞类别

N/A

来源：美国国家漏洞数据库 NVD

二、漏洞 CVE-2022-49667 的公开POC

#	POC 描述	源链接	神龙链接

三、漏洞 CVE-2022-49667 的情报信息

标题： net: bonding: fix use-after-free after 802.3ad slave unbind - kernel/git/stable/linux.git - Linux kernel stable tree -- 🔗来源链接

标签：
标题： net: bonding: fix use-after-free after 802.3ad slave unbind - kernel/git/stable/linux.git - Linux kernel stable tree -- 🔗来源链接

标签：
标题： net: bonding: fix use-after-free after 802.3ad slave unbind - kernel/git/stable/linux.git - Linux kernel stable tree -- 🔗来源链接

标签：
标题： net: bonding: fix use-after-free after 802.3ad slave unbind - kernel/git/stable/linux.git - Linux kernel stable tree -- 🔗来源链接

标签：
标题： net: bonding: fix use-after-free after 802.3ad slave unbind - kernel/git/stable/linux.git - Linux kernel stable tree -- 🔗来源链接

标签：
标题： net: bonding: fix use-after-free after 802.3ad slave unbind - kernel/git/stable/linux.git - Linux kernel stable tree -- 🔗来源链接

标签：
标题： net: bonding: fix use-after-free after 802.3ad slave unbind - kernel/git/stable/linux.git - Linux kernel stable tree -- 🔗来源链接

标签：
标题： net: bonding: fix use-after-free after 802.3ad slave unbind - kernel/git/stable/linux.git - Linux kernel stable tree -- 🔗来源链接

标签：
https://nvd.nist.gov/vuln/detail/CVE-2022-49667