1198025 – (CVE-2022-1204) VUL-0: CVE-2022-1204: kernel-source: Use after free in net/ax25/af_ax25.c

Bug 1198025 (CVE-2022-1204) - VUL-0: CVE-2022-1204: kernel-source: Use after free in net/ax25/af_ax25.c

Summary: VUL-0: CVE-2022-1204: kernel-source: Use after free in net/ax25/af_ax25.c

Status:	RESOLVED FIXED

Alias:	CVE-2022-1204

Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents (show other bugs)
Version:	unspecified
Hardware:	Other Other

Priority:	P3 - Medium Severity: Normal
Target Milestone:	---
Assignee:	Security Team bot
QA Contact:	Security Team bot

URL:	https://smash.suse.de/issue/327883/
Whiteboard:	CVSSv3.1:SUSE:CVE-2022-1204:5.1:(AV:L...
Keywords:

Depends on:
Blocks:

Clone This Bug

Reported:	2022-04-04 14:11 UTC by Gabriele Sonnu
Modified:	2024-06-25 16:47 UTC (History)
CC List:	5 users (show)

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Gabriele Sonnu 2022-04-04 14:11:17 UTC

There are use-after-free vulnerabilities in net/ax25/af_ax25.c of linux that allow  attacker to crash linux kernel by simulating Amateur Radio from user-space.

Upstream fix:

https://github.com/torvalds/linux/commit/d01ffb9eee4af165d83b08dd73ebdf9fe94a519b
https://github.com/torvalds/linux/commit/87563a043cef044fed5db7967a75741cc16ad2b1
https://github.com/torvalds/linux/commit/feef318c855a361a1eccd880f33e88c460eb63b4
https://github.com/torvalds/linux/commit/9fd75b66b8f68498454d685dc4ba13192ae069b0
https://github.com/torvalds/linux/commit/5352a761308397a0e6250fdc629bb3f615b94747

References:
https://bugzilla.redhat.com/show_bug.cgi?id=2071051
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-1204
https://seclists.org/oss-sec/2022/q2/1

Comment 1 Takashi Iwai 2022-04-04 15:36:02 UTC

The ax25 stuff is enabled on SLE15-SP3 and SLE15-SP4 but shipped only with kernel-*-optional for Leap.

Comment 2 Gabriele Sonnu 2022-04-04 15:56:01 UTC

Tracking as affected:

- SLE15-SP3 
- SLE15-SP4

Comment 3 Petr Mladek 2022-05-06 11:50:04 UTC

This bug seems to approach a good date for CVE SLA fulfillment [1].
What is its status, please?
 
[1] https://confluence.suse.com/display/KSS/Kernel+Security+Sentinel

Comment 4 Takashi Iwai 2022-05-23 12:14:13 UTC

All fixes have been already backported to both SLE15-SP3 and SLE15-SP4 for other CVE entries (CVE-2022-1205 CVE-2022-1199 bsc#1198027 bsc#1198028).
I updated the patch reference to point to this one, too.

Reassigned back to security team.