CVE-2022-50243

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: sctp: handle the error returned from sctp_auth_asoc_init_active_key When it returns an error from sctp_auth_asoc_init_active_key(), the active_key is actually not updated. The old sh_key will be freeed while it's still used as active key in asoc. Then an use-after-free will be triggered when sending patckets, as found by syzbot: sctp_auth_shkey_hold+0x22/0xa0 net/sctp/auth.c:112 sctp_set_owner_w net/sctp/socket.c:132 [inline] sctp_sendmsg_to_asoc+0xbd5/0x1a20 net/sctp/socket.c:1863 sctp_sendmsg+0x1053/0x1d50 net/sctp/socket...

Affected product and versions

Product

Linux Linux, linux kernel

Affected versions

>= 50b57223da67653c61e405d0a7592355cfe4585e < b8fa99a3a11bdd77fef6b4a97f1021eb30b5ba40, >= b60461696a0b0fdaf240bc365b7983698f88ded2 < 382ff44716603a54f5fd238ddec6a2468e217612, >= 8eb225873246312660ccd68296959a7b213d0cdd < f65955340e0044f5c41ac799a01698ac7dee8a4e, >= 58acd10092268831e49de279446c314727101292 < 19d636b663e0e92951bba5fced929ca7fd25c552, >= 58acd10092268831e49de279446c314727101292 < 0f90099d18e3abdc01babf686f41f63fe04939c1, >= 58acd10092268831e49de279446c314727101292 < 3b0fcf5e29c0940e1169ce9c44f73edd98bdf12d, >= 58acd10092268831e49de279446c314727101292 < 022152aaebe116a25c39818a07e175a8cd3c1e11, >= c1de376423a7759bf4fa25d6a038a4c1e035c9e1, >= 4.19.199 < 4.19.262, >= 5.4.136 < 5.4.220, >= 5.10.54 < 5.10.150, >= 5.13.6 < 5.14, >= 5.14, >= 5.14.1 < 5.15.75, >= 5.16 < 5.19.17, >= 6.0 < 6.0.3, 5.14

Fixed versions

4.19.262, 5.4.220, 5.10.150, 5.14, 5.15.75, 5.19.17, 6.0.3

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416