In the Linux kernel, the following vulnerability has been resolved:
net: bonding: fix use-after-free after 802.3ad slave unbind
commit 0622cab0341c ("bonding: fix 802.3ad aggregator reselection"), resolve case, when there is several aggregation groups in the same bond. bond3adunbindslave will invalidate (clear) aggregator when _aggactiveports return zero. So, adclearagg can be executed even, when numofports!=0. Than bond3adunbindslave can be executed again for, previously cleared aggregator. NOTE: at this time bond3adunbindslave will not update slave ports list, because lag_ports==NULL. So, here we got slave ports, pointing to freed aggregator memory.
Fix with checking actual number of ports in group (as was before commit 0622cab0341c ("bonding: fix 802.3ad aggregator reselection") ), before adclearagg().
The KASAN logs are as follows:
[ 767.617392] ================================================================== [ 767.630776] BUG: KASAN: use-after-free in bond3adstatemachinehandler+0x13dc/0x1470 [ 767.638764] Read of size 2 at addr ffff00011ba9d430 by task kworker/u8:7/767 [ 767.647361] CPU: 3 PID: 767 Comm: kworker/u8:7 Tainted: G O 5.15.11 #15 [ 767.655329] Hardware name: DNI AmazonGo1 A7040 board (DT) [ 767.660760] Workqueue: lacp1 bond3adstatemachinehandler [ 767.666468] Call trace: [ 767.668930] dumpbacktrace+0x0/0x2d0 [ 767.672625] showstack+0x24/0x30 [ 767.675965] dumpstacklvl+0x68/0x84 [ 767.679659] printaddressdescription.constprop.0+0x74/0x2b8 [ 767.685451] kasanreport+0x1f0/0x260 [ 767.689148] _asanload2+0x94/0xd0 [ 767.692667] bond3adstatemachinehandler+0x13dc/0x1470
{ "vanir_signatures": [ { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "312543026571800232995254207401845141405", "286819470085155317812116930445153107612", "152335222739267707558033031847678114895", "2387205168097093901253180590753119117" ] }, "id": "CVE-2022-49667-017d4a71", "deprecated": false, "target": { "file": "drivers/net/bonding/bond_3ad.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2765749def4765c5052a4c66445cf4c96fcccdbc" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "312543026571800232995254207401845141405", "286819470085155317812116930445153107612", "321910411220684119105676546162743242887", "126541791840775535775733871522964332667" ] }, "id": "CVE-2022-49667-0c791dab", "deprecated": false, "target": { "file": "drivers/net/bonding/bond_3ad.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f162f7c348fa2a5555bafdb5cc890b89b221e69c" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "312543026571800232995254207401845141405", "286819470085155317812116930445153107612", "152335222739267707558033031847678114895", "2387205168097093901253180590753119117" ] }, "id": "CVE-2022-49667-1342e34e", "deprecated": false, "target": { "file": "drivers/net/bonding/bond_3ad.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ef0af7d08d26c5333ff4944a559279464edf6f15" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "312543026571800232995254207401845141405", "286819470085155317812116930445153107612", "152335222739267707558033031847678114895", "2387205168097093901253180590753119117" ] }, "id": "CVE-2022-49667-1ba47e5b", "deprecated": false, "target": { "file": "drivers/net/bonding/bond_3ad.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@050133e1aa2cb49bb17be847d48a4431598ef562" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "312543026571800232995254207401845141405", "286819470085155317812116930445153107612", "152335222739267707558033031847678114895", "2387205168097093901253180590753119117" ] }, "id": "CVE-2022-49667-26b67393", "deprecated": false, "target": { "file": "drivers/net/bonding/bond_3ad.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@893825289ba840afd86bfffcb6f7f363c73efff8" }, { "signature_version": "v1", "digest": { "length": 3401.0, "function_hash": "27997106169256380818783275766667545588" }, "id": "CVE-2022-49667-3a7a9b66", "deprecated": false, "target": { "function": "bond_3ad_unbind_slave", "file": "drivers/net/bonding/bond_3ad.c" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f162f7c348fa2a5555bafdb5cc890b89b221e69c" }, { "signature_version": "v1", "digest": { "length": 3401.0, "function_hash": "27997106169256380818783275766667545588" }, "id": "CVE-2022-49667-42fc515b", "deprecated": false, "target": { "function": "bond_3ad_unbind_slave", "file": "drivers/net/bonding/bond_3ad.c" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b90ac60303063a43e17dd4aec159067599d255e6" }, { "signature_version": "v1", "digest": { "length": 3500.0, "function_hash": "234670156641848078058237601046401249988" }, "id": "CVE-2022-49667-54b4fa2f", "deprecated": false, "target": { "function": "bond_3ad_unbind_slave", "file": "drivers/net/bonding/bond_3ad.c" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2765749def4765c5052a4c66445cf4c96fcccdbc" }, { "signature_version": "v1", "digest": { "length": 3401.0, "function_hash": "27997106169256380818783275766667545588" }, "id": "CVE-2022-49667-59f95124", "deprecated": false, "target": { "function": "bond_3ad_unbind_slave", "file": "drivers/net/bonding/bond_3ad.c" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a853b7a3a9fd1d74a4ccdd9cd73512b7dace2f1e" }, { "signature_version": "v1", "digest": { "length": 3492.0, "function_hash": "198237762670257006686468118250517614664" }, "id": "CVE-2022-49667-5c373d78", "deprecated": false, "target": { "function": "bond_3ad_unbind_slave", "file": "drivers/net/bonding/bond_3ad.c" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@893825289ba840afd86bfffcb6f7f363c73efff8" }, { "signature_version": "v1", "digest": { "length": 3500.0, "function_hash": "234670156641848078058237601046401249988" }, "id": "CVE-2022-49667-86e09148", "deprecated": false, "target": { "function": "bond_3ad_unbind_slave", "file": "drivers/net/bonding/bond_3ad.c" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@050133e1aa2cb49bb17be847d48a4431598ef562" }, { "signature_version": "v1", "digest": { "length": 3500.0, "function_hash": "234670156641848078058237601046401249988" }, "id": "CVE-2022-49667-9182c266", "deprecated": false, "target": { "function": "bond_3ad_unbind_slave", "file": "drivers/net/bonding/bond_3ad.c" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@63b2fe509f69b90168a75e04e14573dccf7984e6" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "312543026571800232995254207401845141405", "286819470085155317812116930445153107612", "321910411220684119105676546162743242887", "126541791840775535775733871522964332667" ] }, "id": "CVE-2022-49667-95e12ebf", "deprecated": false, "target": { "file": "drivers/net/bonding/bond_3ad.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b90ac60303063a43e17dd4aec159067599d255e6" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "312543026571800232995254207401845141405", "286819470085155317812116930445153107612", "152335222739267707558033031847678114895", "2387205168097093901253180590753119117" ] }, "id": "CVE-2022-49667-d80fdceb", "deprecated": false, "target": { "file": "drivers/net/bonding/bond_3ad.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@63b2fe509f69b90168a75e04e14573dccf7984e6" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "312543026571800232995254207401845141405", "286819470085155317812116930445153107612", "321910411220684119105676546162743242887", "126541791840775535775733871522964332667" ] }, "id": "CVE-2022-49667-e67c9b77", "deprecated": false, "target": { "file": "drivers/net/bonding/bond_3ad.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a853b7a3a9fd1d74a4ccdd9cd73512b7dace2f1e" }, { "signature_version": "v1", "digest": { "length": 3500.0, "function_hash": "234670156641848078058237601046401249988" }, "id": "CVE-2022-49667-f88a526a", "deprecated": false, "target": { "function": "bond_3ad_unbind_slave", "file": "drivers/net/bonding/bond_3ad.c" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ef0af7d08d26c5333ff4944a559279464edf6f15" } ] }