UBUNTU-CVE-2022-48674
In the Linux kernel, the following vulnerability has been resolved: erofs: fix pcluster use-after-free on UP platforms During stress testing with CONFIG_SMP disabled, KASAN reports as below: ================================================================== BUG: KASAN: use-after-free in __mutex_lock+0xe5/0xc30 Read of size 8 at addr ffff8881094223f8 by task stress/7789 CPU: 0 PID: 7789 Comm: stress Not tainted 6.0.0-rc1-00002-g0d53d2e882f9 #3 Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 Call Trace: <TASK> .. __mutex_lock+0xe5/0xc30 .. z_erofs_do_read_page+0x8ce/0x1560 .. z_erofs_readahead+0x31c/0x580 .. Freed by task 7787 kasan_save_stack+0x1e/0x40 kasan_set_track+0x20/0x30 kasan_set_free_info+0x20/0x40 __kasan_slab_free+0x10c/0x190 kmem_cache_free+0xed/0x380 rcu_core+0x3d5/0xc90 __do_softirq+0x12d/0x389 Last potentially related work creation: kasan_save_stack+0x1e/0x40 __kasan_record_aux_stack+0x97/0xb0 call_rcu+0x3d/0x3f0 erofs_shrink_workstation+0x11f/0x210 erofs_shrink_scan+0xdc/0x170 shrink_slab.constprop.0+0x296/0x530 drop_slab+0x1c/0x70 drop_caches_sysctl_handler+0x70/0x80 proc_sys_call_handler+0x20a/0x2f0 vfs_write+0x555/0x6c0 ksys_write+0xbe/0x160 do_syscall_64+0x3b/0x90 The root cause is that erofs_workgroup_unfreeze() doesn't reset to orig_val thus it causes a race that the pcluster reuses unexpectedly before freeing. Since UP platforms are quite rare now, such path becomes unnecessary. Let's drop such specific-designed path directly instead.
02 / AFFECTED SOFTWARE
Affected packages
63 explicit affected versions
8 explicit affected versions
13 explicit affected versions
50 explicit affected versions
6 explicit affected versions
12 explicit affected versions
6 explicit affected versions
22 explicit affected versions
8 explicit affected versions
19 explicit affected versions
9 explicit affected versions
15 explicit affected versions
7 explicit affected versions
16 explicit affected versions
90 explicit affected versions
35 explicit affected versions
18 explicit affected versions
3 explicit affected versions
92 explicit affected versions
13 explicit affected versions
4 explicit affected versions
23 explicit affected versions
1 explicit affected versions
21 explicit affected versions
16 explicit affected versions
10 explicit affected versions
47 explicit affected versions
7 explicit affected versions
12 explicit affected versions
7 explicit affected versions
12 explicit affected versions
1 explicit affected versions
7 explicit affected versions
80 explicit affected versions
12 explicit affected versions
95 explicit affected versions
103 explicit affected versions
12 explicit affected versions
91 explicit affected versions
10 explicit affected versions
37 explicit affected versions
10 explicit affected versions
1 explicit affected versions
33 explicit affected versions
26 explicit affected versions
13 explicit affected versions
29 explicit affected versions
83 explicit affected versions
13 explicit affected versions
19 explicit affected versions
78 explicit affected versions
18 explicit affected versions
95 explicit affected versions
33 explicit affected versions
23 explicit affected versions
10 explicit affected versions
11 explicit affected versions
12 explicit affected versions
7 explicit affected versions
12 explicit affected versions
93 explicit affected versions
9 explicit affected versions
3 explicit affected versions
16 explicit affected versions
10 explicit affected versions
26 explicit affected versions
29 explicit affected versions
13 explicit affected versions
53 explicit affected versions
16 explicit affected versions
19 explicit affected versions
10 explicit affected versions
3 explicit affected versions
1 explicit affected versions
60 explicit affected versions
51 explicit affected versions
12 explicit affected versions
9 explicit affected versions
27 explicit affected versions
1 explicit affected versions
8 explicit affected versions
5 explicit affected versions
8 explicit affected versions
1 explicit affected versions
10 explicit affected versions
82 explicit affected versions
13 explicit affected versions
47 explicit affected versions
7 explicit affected versions
11 explicit affected versions
10 explicit affected versions
12 explicit affected versions
82 explicit affected versions
44 explicit affected versions
16 explicit affected versions
3 explicit affected versions
13 explicit affected versions
26 explicit affected versions
5 explicit affected versions
37 explicit affected versions
38 explicit affected versions
9 explicit affected versions
9 explicit affected versions
9 explicit affected versions
11 explicit affected versions
17 explicit affected versions
7 explicit affected versions
54 explicit affected versions
4 explicit affected versions
14 explicit affected versions
43 explicit affected versions
48 explicit affected versions
10 explicit affected versions
8 explicit affected versions
14 explicit affected versions
83 explicit affected versions
4 explicit affected versions
72 explicit affected versions
1 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
In the Linux kernel, the following vulnerability has been resolved: erofs: fix pcluster use-after-free on UP platforms During stress testing with CONFIG_SMP disabled, KASAN reports as below: ================================================================== BUG: KASAN: use-after-free in __mutex_lock+0xe5/0xc30 Read of size 8 at addr ffff8881094223f8 by task stress/7789 CPU: 0 PID: 7789 Comm: stress Not tainted 6.0.0-rc1-00002-g0d53d2e882f9 #3 Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 Call Trace: <TASK> .. __mutex_lock+0xe5/0xc30 .. z_erofs_do_read_page+0x8ce/0x1560 .. z_erofs_readahead+0x31c/0x580 .. Freed by task 7787 kasan_save_stack+0x1e/0x40 kasan_set_track+0x20/0x30 kasan_set_free_info+0x20/0x40 __kasan_slab_free+0x10c/0x190 kmem_cache_free+0xed/0x380 rcu_core+0x3d5/0xc90 __do_softirq+0x12d/0x389 Last potentially related work creation: kasan_save_stack+0x1e/0x40 __kasan_record_aux_stack+0x97/0xb0 call_rcu+0x3d/0x3f0 erofs_shrink_workstation+0x11f/0x210 erofs_shrink_scan+0xdc/0x170 shrink_slab.constprop.0+0x296/0x530 drop_slab+0x1c/0x70 drop_caches_sysctl_handler+0x70/0x80 proc_sys_call_handler+0x20a/0x2f0 vfs_write+0x555/0x6c0 ksys_write+0xbe/0x160 do_syscall_64+0x3b/0x90 The root cause is that erofs_workgroup_unfreeze() doesn't reset to orig_val thus it causes a race that the pcluster reuses unexpectedly before freeing. Since UP platforms are quite rare now, such path becomes unnecessary. Let's drop such specific-designed path directly instead.
05 / REFERENCES
Further evidence
- https://git.kernel.org/linus/2f44013e39984c127c6efedf70e6b5f4e9dcf315
- https://git.kernel.org/stable/c/2f44013e39984c127c6efedf70e6b5f4e9dcf315
- https://git.kernel.org/stable/c/8ddd001cef5e82d19192e6861068463ecca5f556
- https://git.kernel.org/stable/c/94c34faaafe7b55adc2d8d881db195b646959b9e
- https://ubuntu.com/security/CVE-2022-48674
- https://ubuntu.com/security/notices/USN-6951-1
- https://ubuntu.com/security/notices/USN-6951-2
- https://ubuntu.com/security/notices/USN-6951-3
- https://ubuntu.com/security/notices/USN-6951-4
- https://ubuntu.com/security/notices/USN-6953-1
- https://ubuntu.com/security/notices/USN-6979-1
- https://www.cve.org/CVERecord?id=CVE-2022-48674