CVE-2022-50555

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

tipc: fix a null-ptr-deref in tipc_topsrv_accept

syzbot found a crash in tipc_topsrv_accept:

KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]

Workqueue: tipc_rcv tipc_topsrv_accept

RIP: 0010:kernel_accept+0x22d/0x350 net/socket.c:3487

Call Trace:

<TASK>

tipc_topsrv_accept+0x197/0x280 net/tipc/topsrv.c:460

process_one_work+0x991/0x1610 kernel/workqueue.c:2289

worker_thread+0x665/0x1080 kernel/workqueue.c:2436

kthread+0x2e4/0x3a0 kernel/kthread.c:376

ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306

It was caused by srv->listener that might be set to null by

tipc_topsrv_stop() in net .exit whereas it's still used in

tipc_topsrv_accept() worker.

srv->listener is protected by srv->idr_lock in tipc_topsrv_stop(), so add

a check for srv->listener under srv->idr_lock in tipc_topsrv_accept() to

avoid the null-ptr-deref. To ensure the lsock is not released during the

tipc

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References