From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B3BD01A83E2 for ; Wed, 26 Feb 2025 01:58:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740535139; cv=none; b=Xbj5wemcDB0uCNPGYvQDltKk3US29GZaI0sVO8OvyG1xPnxd7gXHEMjxe940dXPxSquTVZ1Rq9RcsFwR55b/PSQa1nmT1XNRhSKMWWyDkU8Xxm6W1q8b3kustWBzQ0IoH+vh5PPNce912AfrvK5OkzK8hBjDlD9QnSUt3f1ieqI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740535139; c=relaxed/simple; bh=3GsfcsM9X4GuUJdKgHz8opjFJVliQDlGLN1BMOOp+Vw=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=hwhKauv+kjzEpfgIw/tD3mYX3nnAcBjyr4jrI+a31VI7lGR57fr7Q9gk+6tR3Ig3/PRoJQbRO9dET7a3nwmOciuIcic4nPbD5uuUjwmvEif4z/H4U4ML6f8+dRhEUbIkolDgTai5K2uXQVnqUhSI56hQU6mKQXu7/0ud5gsplc4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=M7NzsE6h; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="M7NzsE6h" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 89E17C4CEDD; Wed, 26 Feb 2025 01:58:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1740535139; bh=3GsfcsM9X4GuUJdKgHz8opjFJVliQDlGLN1BMOOp+Vw=; h=From:To:Cc:Subject:Date:Reply-to:From; b=M7NzsE6hz3/cva1aaOrZtdZEXm+g8VCPS51LRShKMuFbjCGDHBiILIW3YUofKeDl8 2y5VK1cFFEBDAi7ST2BwGly4eMrP49jCzA+uLvEtsZdA/x3n2XIGHZqV4+yQNwHmtL OrGRGx4xGrrWtgKIfV8fg6TlxIir3tQI+y47SlbI= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2022-49114: scsi: libfc: Fix use after free in fc_exch_abts_resp() Date: Wed, 26 Feb 2025 02:55:19 +0100 Message-ID: <2025022602-CVE-2022-49114-86bb@gregkh> X-Mailer: git-send-email 2.48.1 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=2896; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=3GsfcsM9X4GuUJdKgHz8opjFJVliQDlGLN1BMOOp+Vw=; b=owGbwMvMwCRo6H6F97bub03G02pJDOn7SqxeCOrxqVz/79onJfxSQcbznH60FYv5EdaUoKbP9 24mz77WEcvCIMjEICumyPJlG8/R/RWHFL0MbU/DzGFlAhnCwMUpABM5s4VhwbYp857sX1VQuLDK JuKUC8MMo/wl+xjmx3y2yldoftrk87jCnuOx5pFdCWceAgA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: scsi: libfc: Fix use after free in fc_exch_abts_resp() fc_exch_release(ep) will decrease the ep's reference count. When the reference count reaches zero, it is freed. But ep is still used in the following code, which will lead to a use after free. Return after the fc_exch_release() call to avoid use after free. The Linux kernel CVE team has assigned CVE-2022-49114 to this issue. Affected and fixed versions =========================== Fixed in 4.9.311 with commit 4a131d4ea8b581ac9b01d3a72754db4848be3232 Fixed in 4.14.276 with commit 499d198494e77b6533251b9b909baf5c101129cb Fixed in 4.19.238 with commit 6044ad64f41c87382cfeeca281573d1886d80cbe Fixed in 5.4.189 with commit 5cf2ce8967b0d98c8cfa4dc42ef4fcf080f5c836 Fixed in 5.10.111 with commit 1d7effe5fff9d28e45e18ac3a564067c7ddfe898 Fixed in 5.15.34 with commit f581df412bc45c95176e3c808ee2839c05b2ab0c Fixed in 5.16.20 with commit 87909291762d08fdb60d19069d7a89b5b308d0ef Fixed in 5.17.3 with commit 412dd8299b02e4410fe77b8396953c1a8dde183a Fixed in 5.18 with commit 271add11994ba1a334859069367e04d2be2ebdd4 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2022-49114 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/scsi/libfc/fc_exch.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/4a131d4ea8b581ac9b01d3a72754db4848be3232 https://git.kernel.org/stable/c/499d198494e77b6533251b9b909baf5c101129cb https://git.kernel.org/stable/c/6044ad64f41c87382cfeeca281573d1886d80cbe https://git.kernel.org/stable/c/5cf2ce8967b0d98c8cfa4dc42ef4fcf080f5c836 https://git.kernel.org/stable/c/1d7effe5fff9d28e45e18ac3a564067c7ddfe898 https://git.kernel.org/stable/c/f581df412bc45c95176e3c808ee2839c05b2ab0c https://git.kernel.org/stable/c/87909291762d08fdb60d19069d7a89b5b308d0ef https://git.kernel.org/stable/c/412dd8299b02e4410fe77b8396953c1a8dde183a https://git.kernel.org/stable/c/271add11994ba1a334859069367e04d2be2ebdd4