{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2022-49667","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-02-26T02:21:30.436Z","datePublished":"2025-02-26T02:24:01.818Z","dateUpdated":"2025-05-04T08:42:54.979Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2025-05-04T08:42:54.979Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bonding: fix use-after-free after 802.3ad slave unbind\n\ncommit 0622cab0341c (\"bonding: fix 802.3ad aggregator reselection\"),\nresolve case, when there is several aggregation groups in the same bond.\nbond_3ad_unbind_slave will invalidate (clear) aggregator when\n__agg_active_ports return zero. So, ad_clear_agg can be executed even, when\nnum_of_ports!=0. Than bond_3ad_unbind_slave can be executed again for,\npreviously cleared aggregator. NOTE: at this time bond_3ad_unbind_slave\nwill not update slave ports list, because lag_ports==NULL. So, here we\ngot slave ports, pointing to freed aggregator memory.\n\nFix with checking actual number of ports in group (as was before\ncommit 0622cab0341c (\"bonding: fix 802.3ad aggregator reselection\") ),\nbefore ad_clear_agg().\n\nThe KASAN logs are as follows:\n\n[  767.617392] ==================================================================\n[  767.630776] BUG: KASAN: use-after-free in bond_3ad_state_machine_handler+0x13dc/0x1470\n[  767.638764] Read of size 2 at addr ffff00011ba9d430 by task kworker/u8:7/767\n[  767.647361] CPU: 3 PID: 767 Comm: kworker/u8:7 Tainted: G           O 5.15.11 #15\n[  767.655329] Hardware name: DNI AmazonGo1 A7040 board (DT)\n[  767.660760] Workqueue: lacp_1 bond_3ad_state_machine_handler\n[  767.666468] Call trace:\n[  767.668930]  dump_backtrace+0x0/0x2d0\n[  767.672625]  show_stack+0x24/0x30\n[  767.675965]  dump_stack_lvl+0x68/0x84\n[  767.679659]  print_address_description.constprop.0+0x74/0x2b8\n[  767.685451]  kasan_report+0x1f0/0x260\n[  767.689148]  __asan_load2+0x94/0xd0\n[  767.692667]  bond_3ad_state_machine_handler+0x13dc/0x1470"}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/bonding/bond_3ad.c"],"versions":[{"version":"0622cab0341cac6b30da177b0faa39fae0680e71","lessThan":"a853b7a3a9fd1d74a4ccdd9cd73512b7dace2f1e","status":"affected","versionType":"git"},{"version":"0622cab0341cac6b30da177b0faa39fae0680e71","lessThan":"b90ac60303063a43e17dd4aec159067599d255e6","status":"affected","versionType":"git"},{"version":"0622cab0341cac6b30da177b0faa39fae0680e71","lessThan":"f162f7c348fa2a5555bafdb5cc890b89b221e69c","status":"affected","versionType":"git"},{"version":"0622cab0341cac6b30da177b0faa39fae0680e71","lessThan":"893825289ba840afd86bfffcb6f7f363c73efff8","status":"affected","versionType":"git"},{"version":"0622cab0341cac6b30da177b0faa39fae0680e71","lessThan":"63b2fe509f69b90168a75e04e14573dccf7984e6","status":"affected","versionType":"git"},{"version":"0622cab0341cac6b30da177b0faa39fae0680e71","lessThan":"ef0af7d08d26c5333ff4944a559279464edf6f15","status":"affected","versionType":"git"},{"version":"0622cab0341cac6b30da177b0faa39fae0680e71","lessThan":"2765749def4765c5052a4c66445cf4c96fcccdbc","status":"affected","versionType":"git"},{"version":"0622cab0341cac6b30da177b0faa39fae0680e71","lessThan":"050133e1aa2cb49bb17be847d48a4431598ef562","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/bonding/bond_3ad.c"],"versions":[{"version":"4.7","status":"affected"},{"version":"0","lessThan":"4.7","status":"unaffected","versionType":"semver"},{"version":"4.9.322","lessThanOrEqual":"4.9.*","status":"unaffected","versionType":"semver"},{"version":"4.14.287","lessThanOrEqual":"4.14.*","status":"unaffected","versionType":"semver"},{"version":"4.19.251","lessThanOrEqual":"4.19.*","status":"unaffected","versionType":"semver"},{"version":"5.4.204","lessThanOrEqual":"5.4.*","status":"unaffected","versionType":"semver"},{"version":"5.10.129","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.53","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"5.18.10","lessThanOrEqual":"5.18.*","status":"unaffected","versionType":"semver"},{"version":"5.19","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"4.9.322"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"4.14.287"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"4.19.251"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"5.4.204"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"5.10.129"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"5.15.53"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"5.18.10"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"5.19"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/a853b7a3a9fd1d74a4ccdd9cd73512b7dace2f1e"},{"url":"https://git.kernel.org/stable/c/b90ac60303063a43e17dd4aec159067599d255e6"},{"url":"https://git.kernel.org/stable/c/f162f7c348fa2a5555bafdb5cc890b89b221e69c"},{"url":"https://git.kernel.org/stable/c/893825289ba840afd86bfffcb6f7f363c73efff8"},{"url":"https://git.kernel.org/stable/c/63b2fe509f69b90168a75e04e14573dccf7984e6"},{"url":"https://git.kernel.org/stable/c/ef0af7d08d26c5333ff4944a559279464edf6f15"},{"url":"https://git.kernel.org/stable/c/2765749def4765c5052a4c66445cf4c96fcccdbc"},{"url":"https://git.kernel.org/stable/c/050133e1aa2cb49bb17be847d48a4431598ef562"}],"title":"net: bonding: fix use-after-free after 802.3ad slave unbind","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.8,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2022-49667","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2025-02-27T18:15:14.271545Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-416","description":"CWE-416 Use After Free"}]}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-02-27T18:22:31.234Z"}}]}}