Bug 1204922 (CVE-2022-44033)

Summary:	VUL-0: CVE-2022-44033: kernel-source,kernel-source-rt,kernel-source-azure: An issue was discovered in the Linux kernel through 6.0.6. drivers/char/pcmcia/cm4040_cs.c has a race condition and resultant use-after-free if a physically proximat
Product:	[Novell Products] SUSE Security Incidents	Reporter:	Stoyan Manolov <stoyan.manolov>
Component:	Incidents	Assignee:	Security Team bot <security-team>
Status:	RESOLVED FIXED	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P3 - Medium	CC:	jslaby, mkoutny, security-team
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/346614/
See Also:	https://bugzilla.suse.com/show_bug.cgi?id=1204894
Whiteboard:	CVSSv3.1:SUSE:CVE-2022-44033:4.3:(AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description Stoyan Manolov 2022-11-01 09:05:32 UTC

CVE-2022-44033

An issue was discovered in the Linux kernel through 6.0.6.
drivers/char/pcmcia/cm4040_cs.c has a race condition and resultant
use-after-free if a physically proximate attacker removes a PCMCIA device while
calling open(), aka a race condition between cm4040_open() and reader_detach().

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-44033
https://www.cve.org/CVERecord?id=CVE-2022-44033
http://www.cvedetails.com/cve/CVE-2022-44033/
https://lore.kernel.org/lkml/20220919040457.GA302681@ubuntu/
https://lore.kernel.org/lkml/20220915020834.GA110086@ubuntu/

Comment 2 Michal Koutný 2022-11-01 14:58:59 UTC

Reassigning to a concrete person to ensure progress [1] (feel free to pass to next one), see also the process at [2].
 
This looks visually like a dup of bug 1204894 but it's actually some analogous code in the same driver. Impact and solution seems equal though.
 
[1] https://confluence.suse.com/display/KSS/Kernel+Security+Sentinel
[2] https://wiki.suse.net/index.php/SUSE-Labs/Kernel/Security

Comment 3 Jiri Slaby 2022-11-02 06:58:48 UTC

(In reply to Michal Koutný from comment #2)
> This looks visually like a dup of bug 1204894 but it's actually some
> analogous code in the same driver. Impact and solution seems equal though.

It's cm4040, not cm4000 (bug 1204894).

Comment 4 Jiri Slaby 2022-11-02 07:29:45 UTC

Pushed to stable & cve 3.0.

Comment 9 Swamp Workflow Management 2023-02-15 14:26:43 UTC

SUSE-SU-2023:0416-1: An update that solves 62 vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1055710,1084513,1131430,1133374,1154848,1166098,1173514,1177471,1191961,1196973,1197331,1197343,1197366,1197391,1198516,1198829,1199063,1199426,1199487,1199650,1199657,1200598,1200619,1200692,1200910,1201050,1201251,1201429,1201635,1201636,1201940,1201948,1202097,1202346,1202347,1202393,1202500,1202897,1202898,1202960,1203107,1203271,1203514,1203769,1203960,1203987,1204166,1204354,1204405,1204431,1204439,1204574,1204631,1204646,1204647,1204653,1204894,1204922,1205220,1205514,1205671,1205796,1206677
CVE References: CVE-2017-13695,CVE-2018-7755,CVE-2019-3837,CVE-2019-3900,CVE-2020-15393,CVE-2020-16119,CVE-2020-36557,CVE-2020-36558,CVE-2021-26341,CVE-2021-33655,CVE-2021-33656,CVE-2021-34981,CVE-2021-39713,CVE-2021-45868,CVE-2022-1011,CVE-2022-1048,CVE-2022-1353,CVE-2022-1462,CVE-2022-1652,CVE-2022-1679,CVE-2022-20132,CVE-2022-20166,CVE-2022-20368,CVE-2022-20369,CVE-2022-21123,CVE-2022-21125,CVE-2022-21127,CVE-2022-21166,CVE-2022-21180,CVE-2022-21385,CVE-2022-21499,CVE-2022-2318,CVE-2022-2663,CVE-2022-28356,CVE-2022-29900,CVE-2022-29901,CVE-2022-3028,CVE-2022-3303,CVE-2022-33981,CVE-2022-3424,CVE-2022-3524,CVE-2022-3565,CVE-2022-3566,CVE-2022-3586,CVE-2022-3621,CVE-2022-3635,CVE-2022-3646,CVE-2022-3649,CVE-2022-36879,CVE-2022-36946,CVE-2022-3903,CVE-2022-39188,CVE-2022-40768,CVE-2022-4095,CVE-2022-41218,CVE-2022-41848,CVE-2022-41850,CVE-2022-41858,CVE-2022-43750,CVE-2022-44032,CVE-2022-44033,CVE-2022-45934
JIRA References: 
Sources used:
SUSE Linux Enterprise Server 11-SP4-LTSS-EXTREME-CORE (src):    kernel-default-3.0.101-108.138.1, kernel-ec2-3.0.101-108.138.1, kernel-source-3.0.101-108.138.1, kernel-syms-3.0.101-108.138.1, kernel-trace-3.0.101-108.138.1, kernel-xen-3.0.101-108.138.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.