In the Linux kernel, the following vulnerability has been resolved:
rtnetlink: make sure to refresh masterdev/mops in _rtnlnewlink()
While looking at one unrelated syzbot bug, I found the replay logic in _rtnlnewlink() to potentially trigger use-after-free.
It is better to clear masterdev and mops inside the loop, in case we have to replay it.
[
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bd43771ee9759dd9dfae946bff190e2c5a120de5",
"signature_type": "Function",
"target": {
"function": "__rtnl_newlink",
"file": "net/core/rtnetlink.c"
},
"id": "CVE-2022-48742-e07f02af",
"digest": {
"length": 4982.0,
"function_hash": "330732641882219840564699470471491441816"
},
"deprecated": false
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bd43771ee9759dd9dfae946bff190e2c5a120de5",
"signature_type": "Line",
"target": {
"file": "net/core/rtnetlink.c"
},
"id": "CVE-2022-48742-eb7bd6e0",
"digest": {
"line_hashes": [
"106469260144467483732692883351041067215",
"179174686194431502192709936935857857117",
"159012079740241508342490202189227421548",
"249326808786223552748976530432018601224",
"90353182370848424804865640354074220407",
"328011784653207912208916015932356825075",
"151791946124872816359951909394037447673",
"175024120895933617507676885831655439165"
],
"threshold": 0.9
},
"deprecated": false
}
]