Riskcovery

CVE-2022-49017

tipc: re-fetch skb cb after tipc_msg_validate

State
Published
Severity
8.8 High
Published
Oct 21, 2024
Updated
Aug 5, 2026
Reserved
Aug 22, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

tipc: re-fetch skb cb after tipc_msg_validate

As the call trace shows, the original skb was freed in tipc_msg_validate(), and dereferencing the old skb cb would cause an use-after-free crash.

BUG: KASAN: use-after-free in tipc_crypto_rcv_complete+0x1835/0x2240 [tipc] Call Trace: <IRQ> tipc_crypto_rcv_complete+0x1835/0x2240 [tipc] tipc_crypto_rcv+0xd32/0x1ec0 [tipc] tipc_rcv+0x744/0x1150 [tipc] ... Allocated by task 47078: kmem_cache_alloc_node+0x158/0x4d0 __alloc_skb+0x1c1/0x270 tipc_buf_acquire+0x1e/0xe0 [tipc] tipc_msg_create+0x33/0x1c0 [tipc] tipc_link_build_proto_msg+0x38a/0x2100 [tipc] tipc_link_timeout+0x8b8/0xef0 [tipc] tipc_node_timeout+0x2a1/0x960 [tipc] call_timer_fn+0x2d/0x1c0 ... Freed by task 47078: tipc_msg_validate+0x7b/0x440 [tipc] tipc_crypto_rcv_complete+0x4b5/0x2240 [tipc] tipc_crypto_rcv+0xd32/0x1ec0 [tipc] tipc_rcv+0x744/0x1150 [tipc]

This patch fixes it by re-fetching the skb cb from the new allocated skb after calling tipc_msg_validate().

Scores

CVSSScoreVectorSource
3.18.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 to before a1ba595e35aa3afbe417ff0af353afb9f65559c0Affected
  • fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 to before 1daec0815655e110c6f206c5e777a4af8168ff58Affected
  • fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 to before e128190adb2edfd5042105b5d1ed4553f295f5efAffected
  • fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 to before 3067bc61fcfe3081bf4807ce65560f499e895e77Affected
LinuxLinux
  • 5.5Affected
  • before 5.5Not affected
  • 5.10.158 through 5.10.*Not affected
  • 5.15.82 through 5.15.*Not affected
  • 6.0.12 through 6.0.*Not affected
  • 6.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.