[LTS 8.6] CVE-2022-42720 #593
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
jira VULN-3807 cve-pre CVE-2022-42720 commit-author Rameshkumar Sundaram <[email protected]> commit a5199b5 Synchronize additions to nontrans_list of transmitting BSS with bss_lock to avoid races. Also when cfg80211_add_nontrans_list() fails __cfg80211_unlink_bss() needs bss_lock to be held (has lockdep assert on bss_lock). So protect the whole block with bss_lock to avoid races and warnings. Found during code review. Fixes: 0b8fb82 ("cfg80211: Parsing of Multiple BSSID information in scanning") Signed-off-by: Rameshkumar Sundaram <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Johannes Berg <[email protected]> (cherry picked from commit a5199b5) Signed-off-by: Marcin Wcisło <[email protected]>
jira VULN-3807 cve CVE-2022-42720 commit-author Johannes Berg <[email protected]> commit 0b78088 There are multiple refcounting bugs related to multi-BSSID: - In bss_ref_get(), if the BSS has a hidden_beacon_bss, then the bss pointer is overwritten before checking for the transmitted BSS, which is clearly wrong. Fix this by using the bss_from_pub() macro. - In cfg80211_bss_update() we copy the transmitted_bss pointer from tmp into new, but then if we release new, we'll unref it erroneously. We already set the pointer and ref it, but need to NULL it since it was copied from the tmp data. - In cfg80211_inform_single_bss_data(), if adding to the non- transmitted list fails, we unlink the BSS and yet still we return it, but this results in returning an entry without a reference. We shouldn't return it anyway if it was broken enough to not get added there. This fixes CVE-2022-42720. Reported-by: Sönke Huster <[email protected]> Tested-by: Sönke Huster <[email protected]> Fixes: a3584f5 ("cfg80211: Properly track transmitting and non-transmitting BSS") Signed-off-by: Johannes Berg <[email protected]> (cherry picked from commit 0b78088) Signed-off-by: Marcin Wcisło <[email protected]>
PlaidCat
requested review from
PlaidCat,
kerneltoast,
bmastbergen and
shreeya-patel98
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
[LTS 8.6]
CVE-2022-42720
VULN-3807
Problem
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=0b7808818cb9df6680f98996b8e9a439fa7bcc2f
Affected: yes
The official bug source tagged by the bug fix 0b78088 is a3584f5. This commit can't be found in
ciqlts8_6's history neither natively nor as a backport, although the code introduced by a3584f5 can be found in the bulk commit e19ec64. Along with the naive cherry-pick generating conflicts this situation required a case-by-case analysis of the issues addressed by 0b78088 to confirm their applicability to LTS 8.6 codebase.bss_ref_get()This bug applies to LTS 8.6 with the code path being
kernel-src-tree/net/wireless/scan.c
Lines 147 to 149 in 0f0d831
then
kernel-src-tree/net/wireless/scan.c
Line 152 in 0f0d831
cfg80211_bss_update()This bug applies to LTS 8.6. Below the description interspersed with links to the relevant
ciqlts8_6code fragments:kernel-src-tree/net/wireless/scan.c
Line 1733 in 0f0d831
kernel-src-tree/net/wireless/scan.c
Line 1759 in 0f0d831
kernel-src-tree/net/wireless/scan.c
Line 1766 in 0f0d831
kernel-src-tree/net/wireless/scan.c
Line 181 in 0f0d831
kernel-src-tree/net/wireless/scan.c
Lines 1777 to 1778 in 0f0d831
cfg80211_inform_single_bss_data()This bug applies to LTS 8.6. Failure of adding to the nontransmitted list and unlinking:
kernel-src-tree/net/wireless/scan.c
Lines 1985 to 1989 in 0f0d831
Returning the value without a reference:
kernel-src-tree/net/wireless/scan.c
Line 1994 in 0f0d831
It was arguably introduced earlier than a3584f5, namely in 0b8fb82.
Solution
Applying 0b78088 required pulling in 8a610cf to avoid conflicts for the cfg80211_inform_single_bss_data() case. Coincidentally, another bug was fixed with it (no CVE associated). From the commit's message:
kABI check: passed
Boot test: passed
boot-test.log
Kselftests: passed relative
Reference
kselftests–ciqlts8_6–run1.log
Patch
kselftests–ciqlts8_6-CVE-2022-42720–run1.log
kselftests–ciqlts8_6-CVE-2022-42720–run2.log
Comparison
The tests results for the reference and the patch are the same.