In the Linux kernel, the following vulnerability has been resolved:
sctp: handle the error returned from sctpauthasocinitactive_key
When it returns an error from sctpauthasocinitactivekey(), the activekey is actually not updated. The old sh_key will be freeed while it's still used as active key in asoc. Then an use-after-free will be triggered when sending patckets, as found by syzbot:
sctpauthshkeyhold+0x22/0xa0 net/sctp/auth.c:112 sctpsetownerw net/sctp/socket.c:132 [inline] sctpsendmsgtoasoc+0xbd5/0x1a20 net/sctp/socket.c:1863 sctpsendmsg+0x1053/0x1d50 net/sctp/socket.c:2025 inetsendmsg+0x99/0xe0 net/ipv4/afinet.c:819 socksendmsgnosec net/socket.c:714 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:734
This patch is to fix it by not replacing the shkey when it returns errors from sctpauthasocinitactivekey() in sctpauthsetkey(). For sctpauthsetactivekey(), old activekeyid will be set back to asoc->activekey_id when the same thing happens.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50243.json",
"cna_assigner": "Linux"
}"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-50243.json"
[
{
"id": "CVE-2022-50243-04163ce8",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3b0fcf5e29c0940e1169ce9c44f73edd98bdf12d",
"target": {
"file": "net/sctp/auth.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"28850636265357495592566577798945945186",
"194067361854653024968251076671750102684",
"286406572356836389561447667215631747182",
"273944544286126911343132522615425576427",
"313505225112280038328754988666955331497",
"306127955805276017219327529626874094931",
"11073258240307341960273669284712426231",
"28538450641731605929138508953941427174",
"280031296272510654103448174463959325454",
"238396630738222518784509270232605763931",
"175898317047138494819711557848387272072",
"211182195896578399788160970086209014145",
"12322489886649053390420358454097650829"
]
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"id": "CVE-2022-50243-07026e3d",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@022152aaebe116a25c39818a07e175a8cd3c1e11",
"target": {
"file": "net/sctp/auth.c",
"function": "sctp_auth_set_active_key"
},
"digest": {
"function_hash": "260642530473383737724352416597912646283",
"length": 588.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2022-50243-1c3163ec",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b8fa99a3a11bdd77fef6b4a97f1021eb30b5ba40",
"target": {
"file": "net/sctp/auth.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"28850636265357495592566577798945945186",
"194067361854653024968251076671750102684",
"286406572356836389561447667215631747182",
"273944544286126911343132522615425576427",
"313505225112280038328754988666955331497",
"306127955805276017219327529626874094931",
"11073258240307341960273669284712426231",
"28538450641731605929138508953941427174",
"280031296272510654103448174463959325454",
"238396630738222518784509270232605763931",
"175898317047138494819711557848387272072",
"211182195896578399788160970086209014145",
"12322489886649053390420358454097650829"
]
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"id": "CVE-2022-50243-21ea5031",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@19d636b663e0e92951bba5fced929ca7fd25c552",
"target": {
"file": "net/sctp/auth.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"28850636265357495592566577798945945186",
"194067361854653024968251076671750102684",
"286406572356836389561447667215631747182",
"273944544286126911343132522615425576427",
"313505225112280038328754988666955331497",
"306127955805276017219327529626874094931",
"11073258240307341960273669284712426231",
"28538450641731605929138508953941427174",
"280031296272510654103448174463959325454",
"238396630738222518784509270232605763931",
"175898317047138494819711557848387272072",
"211182195896578399788160970086209014145",
"12322489886649053390420358454097650829"
]
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"id": "CVE-2022-50243-242729c5",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@382ff44716603a54f5fd238ddec6a2468e217612",
"target": {
"file": "net/sctp/auth.c",
"function": "sctp_auth_set_key"
},
"digest": {
"function_hash": "65183161759657524099937178786571949990",
"length": 1009.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2022-50243-2ed662bd",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@022152aaebe116a25c39818a07e175a8cd3c1e11",
"target": {
"file": "net/sctp/auth.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"28850636265357495592566577798945945186",
"194067361854653024968251076671750102684",
"286406572356836389561447667215631747182",
"273944544286126911343132522615425576427",
"313505225112280038328754988666955331497",
"306127955805276017219327529626874094931",
"11073258240307341960273669284712426231",
"28538450641731605929138508953941427174",
"280031296272510654103448174463959325454",
"238396630738222518784509270232605763931",
"175898317047138494819711557848387272072",
"211182195896578399788160970086209014145",
"12322489886649053390420358454097650829"
]
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"id": "CVE-2022-50243-3f9ed34c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3b0fcf5e29c0940e1169ce9c44f73edd98bdf12d",
"target": {
"file": "net/sctp/auth.c",
"function": "sctp_auth_set_key"
},
"digest": {
"function_hash": "65183161759657524099937178786571949990",
"length": 1009.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2022-50243-409959c4",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@382ff44716603a54f5fd238ddec6a2468e217612",
"target": {
"file": "net/sctp/auth.c",
"function": "sctp_auth_set_active_key"
},
"digest": {
"function_hash": "260642530473383737724352416597912646283",
"length": 588.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2022-50243-5dcdc997",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b8fa99a3a11bdd77fef6b4a97f1021eb30b5ba40",
"target": {
"file": "net/sctp/auth.c",
"function": "sctp_auth_set_active_key"
},
"digest": {
"function_hash": "258582217407888111275456618306297284921",
"length": 476.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2022-50243-624aa1ee",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f65955340e0044f5c41ac799a01698ac7dee8a4e",
"target": {
"file": "net/sctp/auth.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"28850636265357495592566577798945945186",
"194067361854653024968251076671750102684",
"286406572356836389561447667215631747182",
"273944544286126911343132522615425576427",
"313505225112280038328754988666955331497",
"306127955805276017219327529626874094931",
"11073258240307341960273669284712426231",
"28538450641731605929138508953941427174",
"280031296272510654103448174463959325454",
"238396630738222518784509270232605763931",
"175898317047138494819711557848387272072",
"211182195896578399788160970086209014145",
"12322489886649053390420358454097650829"
]
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"id": "CVE-2022-50243-72fa019f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3b0fcf5e29c0940e1169ce9c44f73edd98bdf12d",
"target": {
"file": "net/sctp/auth.c",
"function": "sctp_auth_set_active_key"
},
"digest": {
"function_hash": "260642530473383737724352416597912646283",
"length": 588.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2022-50243-8e7a3a22",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0f90099d18e3abdc01babf686f41f63fe04939c1",
"target": {
"file": "net/sctp/auth.c",
"function": "sctp_auth_set_key"
},
"digest": {
"function_hash": "65183161759657524099937178786571949990",
"length": 1009.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2022-50243-91ab7614",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@382ff44716603a54f5fd238ddec6a2468e217612",
"target": {
"file": "net/sctp/auth.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"28850636265357495592566577798945945186",
"194067361854653024968251076671750102684",
"286406572356836389561447667215631747182",
"273944544286126911343132522615425576427",
"313505225112280038328754988666955331497",
"306127955805276017219327529626874094931",
"11073258240307341960273669284712426231",
"28538450641731605929138508953941427174",
"280031296272510654103448174463959325454",
"238396630738222518784509270232605763931",
"175898317047138494819711557848387272072",
"211182195896578399788160970086209014145",
"12322489886649053390420358454097650829"
]
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"id": "CVE-2022-50243-9b5975f8",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b8fa99a3a11bdd77fef6b4a97f1021eb30b5ba40",
"target": {
"file": "net/sctp/auth.c",
"function": "sctp_auth_set_key"
},
"digest": {
"function_hash": "129378499347910125544479108824918371736",
"length": 897.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2022-50243-b216bef0",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f65955340e0044f5c41ac799a01698ac7dee8a4e",
"target": {
"file": "net/sctp/auth.c",
"function": "sctp_auth_set_key"
},
"digest": {
"function_hash": "65183161759657524099937178786571949990",
"length": 1009.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2022-50243-b370b349",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f65955340e0044f5c41ac799a01698ac7dee8a4e",
"target": {
"file": "net/sctp/auth.c",
"function": "sctp_auth_set_active_key"
},
"digest": {
"function_hash": "260642530473383737724352416597912646283",
"length": 588.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2022-50243-c666a31d",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0f90099d18e3abdc01babf686f41f63fe04939c1",
"target": {
"file": "net/sctp/auth.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"28850636265357495592566577798945945186",
"194067361854653024968251076671750102684",
"286406572356836389561447667215631747182",
"273944544286126911343132522615425576427",
"313505225112280038328754988666955331497",
"306127955805276017219327529626874094931",
"11073258240307341960273669284712426231",
"28538450641731605929138508953941427174",
"280031296272510654103448174463959325454",
"238396630738222518784509270232605763931",
"175898317047138494819711557848387272072",
"211182195896578399788160970086209014145",
"12322489886649053390420358454097650829"
]
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"id": "CVE-2022-50243-ced9a1bd",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0f90099d18e3abdc01babf686f41f63fe04939c1",
"target": {
"file": "net/sctp/auth.c",
"function": "sctp_auth_set_active_key"
},
"digest": {
"function_hash": "260642530473383737724352416597912646283",
"length": 588.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2022-50243-ed7680f5",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@19d636b663e0e92951bba5fced929ca7fd25c552",
"target": {
"file": "net/sctp/auth.c",
"function": "sctp_auth_set_active_key"
},
"digest": {
"function_hash": "260642530473383737724352416597912646283",
"length": 588.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2022-50243-f386daa5",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@19d636b663e0e92951bba5fced929ca7fd25c552",
"target": {
"file": "net/sctp/auth.c",
"function": "sctp_auth_set_key"
},
"digest": {
"function_hash": "65183161759657524099937178786571949990",
"length": 1009.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2022-50243-fa3f294f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@022152aaebe116a25c39818a07e175a8cd3c1e11",
"target": {
"file": "net/sctp/auth.c",
"function": "sctp_auth_set_key"
},
"digest": {
"function_hash": "65183161759657524099937178786571949990",
"length": 1009.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
}
]