Bug 1204922 (CVE-2022-44033) - VUL-0: CVE-2022-44033: kernel-source,kernel-source-rt,kernel-source-azure: An issue was discovered in the Linux kernel through 6.0.6. drivers/char/pcmcia/cm4040_cs.c has a race condition and resultant use-after-free if a physically proximat
Summary: VUL-0: CVE-2022-44033: kernel-source,kernel-source-rt,kernel-source-azure: An...
Status: RESOLVED FIXED
Alias: CVE-2022-44033
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/346614/
Whiteboard: CVSSv3.1:SUSE:CVE-2022-44033:4.3:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2022-11-01 09:05 UTC by Stoyan Manolov
Modified: 2023-04-26 14:15 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Stoyan Manolov 2022-11-01 09:05:32 UTC 
CVE-2022-44033

An issue was discovered in the Linux kernel through 6.0.6.
drivers/char/pcmcia/cm4040_cs.c has a race condition and resultant
use-after-free if a physically proximate attacker removes a PCMCIA device while
calling open(), aka a race condition between cm4040_open() and reader_detach().

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-44033
https://www.cve.org/CVERecord?id=CVE-2022-44033
http://www.cvedetails.com/cve/CVE-2022-44033/
https://lore.kernel.org/lkml/20220919040457.GA302681@ubuntu/
https://lore.kernel.org/lkml/20220915020834.GA110086@ubuntu/
Comment 2 Michal Koutný 2022-11-01 14:58:59 UTC 
Reassigning to a concrete person to ensure progress [1] (feel free to pass to next one), see also the process at [2].
 
This looks visually like a dup of bug 1204894 but it's actually some analogous code in the same driver. Impact and solution seems equal though.
 
[1] https://confluence.suse.com/display/KSS/Kernel+Security+Sentinel
[2] https://wiki.suse.net/index.php/SUSE-Labs/Kernel/Security
Comment 3 Jiri Slaby 2022-11-02 06:58:48 UTC 
(In reply to Michal Koutný from comment #2)
> This looks visually like a dup of bug 1204894 but it's actually some
> analogous code in the same driver. Impact and solution seems equal though.

It's cm4040, not cm4000 (bug 1204894).
Comment 4 Jiri Slaby 2022-11-02 07:29:45 UTC 
Pushed to stable & cve 3.0.
Comment 9 Swamp Workflow Management 2023-02-15 14:26:43 UTC 
SUSE-SU-2023:0416-1: An update that solves 62 vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1055710,1084513,1131430,1133374,1154848,1166098,1173514,1177471,1191961,1196973,1197331,1197343,1197366,1197391,1198516,1198829,1199063,1199426,1199487,1199650,1199657,1200598,1200619,1200692,1200910,1201050,1201251,1201429,1201635,1201636,1201940,1201948,1202097,1202346,1202347,1202393,1202500,1202897,1202898,1202960,1203107,1203271,1203514,1203769,1203960,1203987,1204166,1204354,1204405,1204431,1204439,1204574,1204631,1204646,1204647,1204653,1204894,1204922,1205220,1205514,1205671,1205796,1206677
CVE References: CVE-2017-13695,CVE-2018-7755,CVE-2019-3837,CVE-2019-3900,CVE-2020-15393,CVE-2020-16119,CVE-2020-36557,CVE-2020-36558,CVE-2021-26341,CVE-2021-33655,CVE-2021-33656,CVE-2021-34981,CVE-2021-39713,CVE-2021-45868,CVE-2022-1011,CVE-2022-1048,CVE-2022-1353,CVE-2022-1462,CVE-2022-1652,CVE-2022-1679,CVE-2022-20132,CVE-2022-20166,CVE-2022-20368,CVE-2022-20369,CVE-2022-21123,CVE-2022-21125,CVE-2022-21127,CVE-2022-21166,CVE-2022-21180,CVE-2022-21385,CVE-2022-21499,CVE-2022-2318,CVE-2022-2663,CVE-2022-28356,CVE-2022-29900,CVE-2022-29901,CVE-2022-3028,CVE-2022-3303,CVE-2022-33981,CVE-2022-3424,CVE-2022-3524,CVE-2022-3565,CVE-2022-3566,CVE-2022-3586,CVE-2022-3621,CVE-2022-3635,CVE-2022-3646,CVE-2022-3649,CVE-2022-36879,CVE-2022-36946,CVE-2022-3903,CVE-2022-39188,CVE-2022-40768,CVE-2022-4095,CVE-2022-41218,CVE-2022-41848,CVE-2022-41850,CVE-2022-41858,CVE-2022-43750,CVE-2022-44032,CVE-2022-44033,CVE-2022-45934
JIRA References: 
Sources used:
SUSE Linux Enterprise Server 11-SP4-LTSS-EXTREME-CORE (src):    kernel-default-3.0.101-108.138.1, kernel-ec2-3.0.101-108.138.1, kernel-source-3.0.101-108.138.1, kernel-syms-3.0.101-108.138.1, kernel-trace-3.0.101-108.138.1, kernel-xen-3.0.101-108.138.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.