CVE-2022-49667
published 2025-02-26CVE-2022-49667: In the Linux kernel, the following vulnerability has been resolved: net: bonding: fix use-after-free after 802.3ad slave unbind commit 0622cab0341c ("bonding…
PriorityP339high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.29%
21.2th percentile
In the Linux kernel, the following vulnerability has been resolved:
net: bonding: fix use-after-free after 802.3ad slave unbind
commit 0622cab0341c ("bonding: fix 802.3ad aggregator reselection"),
resolve case, when there is several aggregation groups in the same bond.
bond_3ad_unbind_slave will invalidate (clear) aggregator when
__agg_active_ports return zero. So, ad_clear_agg can be executed even, when
num_of_ports!=0. Than bond_3ad_unbind_slave can be executed again for,
previously cleared aggregator. NOTE: at this time bond_3ad_unbind_slave
will not update slave ports list, because lag_ports==NULL. So, here we
got slave ports, pointing to freed aggregator memory.
Fix with checking actual number of ports in group (as was before
commit 0622cab0341c ("bonding: fix 802.3ad aggregator reselection") ),
before ad_clear_agg().
The KASAN logs are as follows:
[ 767.617392] ==================================================================
[ 767.630776] BUG: KASAN: use-after-free in bond_3ad_state_machine_handler+0x13dc/0x1470
[ 767.638764] Read of size 2 at addr ffff00011ba9d430 by task kworker/u8:7/767
[ 767.647361] CPU: 3 PID: 767 Comm: kworker/u8:7 Tainted: G O 5.15.11 #15
[ 767.655329] Hardware name: DNI AmazonGo1 A7040 board (DT)
[ 767.660760] Workqueue: lacp_1 bond_3ad_state_machine_handler
[ 767.666468] Call trace:
[ 767.668930] dump_backtrace+0x0/0x2d0
[ 767.672625] show_stack+0x24/0x30
[ 767.675965] dump_stack_lvl+0x68/0x84
[ 767.679659] print_address_description.constprop.0+0x74/0x2b8
[ 767.685451] kasan_report+0x1f0/0x260
[ 767.689148] __asan_load2+0x94/0xd0
[ 767.692667] bond_3ad_state_machine_handler+0x13dc/0x1470
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.18.14-1 (bookworm) | linux 5.18.14-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 0622cab0341cac6b30da177b0faa39fae0680e71 < a853b7a3a9fd1d74a4ccdd9cd73512b7dace2f1e | a853b7a3a9fd1d74a4ccdd9cd73512b7dace2f1e |
| linux | linux | >= 0622cab0341cac6b30da177b0faa39fae0680e71 < b90ac60303063a43e17dd4aec159067599d255e6 | b90ac60303063a43e17dd4aec159067599d255e6 |
| linux | linux | >= 0622cab0341cac6b30da177b0faa39fae0680e71 < f162f7c348fa2a5555bafdb5cc890b89b221e69c | f162f7c348fa2a5555bafdb5cc890b89b221e69c |
| linux | linux | >= 0622cab0341cac6b30da177b0faa39fae0680e71 < 893825289ba840afd86bfffcb6f7f363c73efff8 | 893825289ba840afd86bfffcb6f7f363c73efff8 |
| linux | linux | >= 0622cab0341cac6b30da177b0faa39fae0680e71 < 63b2fe509f69b90168a75e04e14573dccf7984e6 | 63b2fe509f69b90168a75e04e14573dccf7984e6 |
| linux | linux | >= 0622cab0341cac6b30da177b0faa39fae0680e71 < ef0af7d08d26c5333ff4944a559279464edf6f15 | ef0af7d08d26c5333ff4944a559279464edf6f15 |
| linux | linux | >= 0622cab0341cac6b30da177b0faa39fae0680e71 < 2765749def4765c5052a4c66445cf4c96fcccdbc | 2765749def4765c5052a4c66445cf4c96fcccdbc |
| linux | linux | >= 0622cab0341cac6b30da177b0faa39fae0680e71 < 050133e1aa2cb49bb17be847d48a4431598ef562 | 050133e1aa2cb49bb17be847d48a4431598ef562 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.136-1 | 5.10.136-1 |
| linux | linux_kernel | >= 0 < 5.18.14-1 | 5.18.14-1 |
| linux | linux_kernel | >= 0 < 5.18.14-1 | 5.18.14-1 |
| linux | linux_kernel | >= 0 < 5.18.14-1 | 5.18.14-1 |
| linux | linux_kernel | >= 4.10 < 4.14.287 | 4.14.287 |
| linux | linux_kernel | >= 4.15 < 4.19.251 | 4.19.251 |
| linux | linux_kernel | >= 4.20 < 5.4.204 | 5.4.204 |
| linux | linux_kernel | >= 4.7 < 4.9.322 | 4.9.322 |
| linux | linux_kernel | >= 5.11 < 5.15.53 | 5.15.53 |
| linux | linux_kernel | >= 5.16 < 5.18.10 | 5.18.10 |
| linux | linux_kernel | >= 5.5 < 5.10.129 | 5.10.129 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: net: bonding: fix use-after-free after 802.3ad slave unbind
vendor_redhat·2025-02-26·CVSS 7.8
CVE-2022-49667 [HIGH] CWE-416 kernel: net: bonding: fix use-after-free after 802.3ad slave unbind
kernel: net: bonding: fix use-after-free after 802.3ad slave unbind
In the Linux kernel, the following vulnerability has been resolved:
net: bonding: fix use-after-free after 802.3ad slave unbind
commit 0622cab0341c ("bonding: fix 802.3ad aggregator reselection"),
resolve case, when there is several aggregation groups in the same bond.
bond_3ad_unbind_slave will invalidate (clear) aggregator when
__agg_active_ports return zero. So, ad_clear_agg can be executed even, when
num_of_ports!=0. Than bond_3ad_unbind_slave can be executed again for,
previously cleared aggregator. NOTE: at this time bond_3ad_unbind_slave
will not update slave ports list, because lag_ports==NULL. So, here we
got slave ports, pointing to freed aggregator memory.
Fix with checking actual number of ports in group (as w
Debian
CVE-2022-49667: linux - In the Linux kernel, the following vulnerability has been resolved: net: bondin...
vendor_debian·2022·CVSS 7.8
CVE-2022-49667 [HIGH] CVE-2022-49667: linux - In the Linux kernel, the following vulnerability has been resolved: net: bondin...
In the Linux kernel, the following vulnerability has been resolved: net: bonding: fix use-after-free after 802.3ad slave unbind commit 0622cab0341c ("bonding: fix 802.3ad aggregator reselection"), resolve case, when there is several aggregation groups in the same bond. bond_3ad_unbind_slave will invalidate (clear) aggregator when __agg_active_ports return zero. So, ad_clear_agg can be executed even, when num_of_ports!=0. Than bond_3ad_unbind_slave can be executed again for, previously cleared aggregator. NOTE: at this time bond_3ad_unbind_slave will not update slave ports list, because lag_ports==NULL. So, here we got slave ports, pointing to freed aggregator memory. Fix with checking actual number of ports in group (as was before commit 0622cab0341c ("bonding: fix 802.3ad aggregator resel
GHSA
GHSA-5wq4-958x-w5fq: In the Linux kernel, the following vulnerability has been resolved:
net: bonding: fix use-after-free after 802
ghsa_unreviewed·2025-02-27
CVE-2022-49667 [HIGH] CWE-416 GHSA-5wq4-958x-w5fq: In the Linux kernel, the following vulnerability has been resolved:
net: bonding: fix use-after-free after 802
In the Linux kernel, the following vulnerability has been resolved:
net: bonding: fix use-after-free after 802.3ad slave unbind
commit 0622cab0341c ("bonding: fix 802.3ad aggregator reselection"),
resolve case, when there is several aggregation groups in the same bond.
bond_3ad_unbind_slave will invalidate (clear) aggregator when
__agg_active_ports return zero. So, ad_clear_agg can be executed even, when
num_of_ports!=0. Than bond_3ad_unbind_slave can be executed again for,
previously cleared aggregator. NOTE: at this time bond_3ad_unbind_slave
will not update slave ports list, because lag_ports==NULL. So, here we
got slave ports, pointing to freed aggregator memory.
Fix with checking actual number of ports in group (as was before
commit 0622cab0341c ("bonding: fix 802.3ad aggregator re
OSV
CVE-2022-49667: In the Linux kernel, the following vulnerability has been resolved: net: bonding: fix use-after-free after 802
osv·2025-02-26·CVSS 7.8
CVE-2022-49667 [HIGH] CVE-2022-49667: In the Linux kernel, the following vulnerability has been resolved: net: bonding: fix use-after-free after 802
In the Linux kernel, the following vulnerability has been resolved: net: bonding: fix use-after-free after 802.3ad slave unbind commit 0622cab0341c ("bonding: fix 802.3ad aggregator reselection"), resolve case, when there is several aggregation groups in the same bond. bond_3ad_unbind_slave will invalidate (clear) aggregator when __agg_active_ports return zero. So, ad_clear_agg can be executed even, when num_of_ports!=0. Than bond_3ad_unbind_slave can be executed again for, previously cleared aggregator. NOTE: at this time bond_3ad_unbind_slave will not update slave ports list, because lag_ports==NULL. So, here we got slave ports, pointing to freed aggregator memory. Fix with checking actual number of ports in group (as was before commit 0622cab0341c ("bonding: fix 802.3ad aggregator resel
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/050133e1aa2cb49bb17be847d48a4431598ef562https://git.kernel.org/stable/c/2765749def4765c5052a4c66445cf4c96fcccdbchttps://git.kernel.org/stable/c/63b2fe509f69b90168a75e04e14573dccf7984e6https://git.kernel.org/stable/c/893825289ba840afd86bfffcb6f7f363c73efff8https://git.kernel.org/stable/c/a853b7a3a9fd1d74a4ccdd9cd73512b7dace2f1ehttps://git.kernel.org/stable/c/b90ac60303063a43e17dd4aec159067599d255e6https://git.kernel.org/stable/c/ef0af7d08d26c5333ff4944a559279464edf6f15https://git.kernel.org/stable/c/f162f7c348fa2a5555bafdb5cc890b89b221e69c
2025-02-26
Published