Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <YlRZ0MNxf3lyr/nE@dojo.mi.org>
Date: Mon, 11 Apr 2022 12:39:44 -0400
From: "Mike O'Connor" <mjo@...o.mi.org>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2022-28893: Linux kernel: Use after free in
 SUNRPC subsystem

:On Mon, Apr 11, 2022 at 04:20:56PM +0800, Felix Fu wrote:
:> Hello, I Request a CVE from MITRE.
:> 
:> Description: The SUNRPC subsystem in the Linux kernel through 5.17.2 can
:> call xs_xprt_free before ensuring that sockets are in the intended state.
:> Details: Use after free happens in inet_put_port because some sockets are
:> not close before xs_xprt_free().
:> CVE-ID: CVE-2022-28893  (
:> https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28893)
:> Fix:
:> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1a3b1bba7c7a5eb8a11513cf88427cb9d77bc60a
:
:This is a merge commit, not the actual commit that fixed the issue :(

https://github.com/torvalds/linux/commit/f00432063db1a0db484e85193eccc6845435b80e

appears to be the actual commit that fixed the issue.

-Mike

-- 
 Michael J. O'Connor                                          mjo@...o.mi.org
 =--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--=
"Holy one-track Batcomputer mind!!!"                   -Robin, the Boy Wonder

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.