CVE: CVE-2022-49695
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

igb: fix a use-after-free issue in igb_clean_tx_ring

Fix the following use-after-free bug in igb_clean_tx_ring routine when
the NIC is running in XDP mode. The issue can be triggered redirecting
traffic into the igb NIC and then closing the device while the traffic
is flowing.

[   73.322719] CPU: 1 PID: 487 Comm: xdp_redirect Not tainted 5.18.3-apu2 #9
[   73.330639] Hardware name: PC Engines APU2/APU2, BIOS 4.0.7 02/28/2017
[   73.337434] RIP: 0010:refcount_warn_saturate+0xa7/0xf0
[   73.362283] RSP: 0018:ffffc9000081f798 EFLAGS: 00010282
[   73.367761] RAX: [PII_REDACTED] RBX: ffffc90000420f80 RCX: [PII_REDACTED]
[   73.375200] RDX: ffff88811ad22d00 RSI: ffff88811ad171e0 RDI: ffff88811ad171e0
[   73.382590] RBP: [PII_REDACTED] R08: ffffffff82298f28 R09: [PII_REDACTED]
[   73.390008] R10: [PII_REDACTED] R11: ffffffff82280f40 R12: [PII_REDACTED]
[   73.397356] R13: ffff888102343a40 R14: ffff88810359e0e4 R15: [PII_REDACTED]
[   73.404806] FS:  00007ff38d31d740(0000) GS:ffff88811ad00000(0000) knlGS:[PII_REDACTED]
[   73.413129] CS:  0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
[   73.419096] CR2: 000055cff35f13f8 CR3: [PII_REDACTED] CR4:[PII_REDACTED]0406e0
[   73.426565] Call Trace:
[   73.429087]  <TASK>
[   73.431314]  igb_clean_tx_ring+0x43/0x140 [igb]
[   73.436002]  igb_down+0x1d7/0x220 [igb]
[   73.439974]  __igb_close+0x3c/0x120 [igb]
[   73.444118]  igb_xdp+0x10c/0x150 [igb]
[   73.447983]  ? igb_pci_sriov_configure+0x70/0x70 [igb]
[   73.453362]  dev_xdp_install+0xda/0x110
[   73.457371]  dev_xdp_attach+0x1da/0x550
[   73.461369]  do_setlink+0xfd0/0x10f0
[   73.465166]  ? __nla_validate_parse+0x89/0xc70
[   73.469714]  rtnl_setlink+0x11a/0x1e0
[   73.473547]  rtnetlink_rcv_msg+0x145/0x3d0
[   73.477709]  ? rtnl_calcit.isra.0+0x130/0x130
[   73.482258]  netlink_rcv_skb+0x8d/0x110
[   73.486229]  netlink_unicast+0x230/0x340
[   73.490317]  netlink_sendmsg+0x215/0x470
[   73.494395]  __sys_sendto+0x179/0x190
[   73.498268]  ? move_addr_to_user+0x37/0x70
[   73.502547]  ? __sys_getsockname+0x84/0xe0
[   73.506853]  ? netlink_setsockopt+0x1c1/0x4a0
[   73.511349]  ? __sys_setsockopt+0xc8/0x1d0
[   73.515636]  __x64_sys_sendto+0x20/0x30
[   73.519603]  do_syscall_64+0x3b/0x80
[   73.523399]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[   73.528712] RIP: 0033:0x7ff38d41f20c
[   73.551866] RSP: 002b:00007fff3b945a68 EFLAGS: 00000246 ORIG_RAX:[PII_REDACTED]00002c
[   73.559640] RAX: ffffffffffffffda RBX: [PII_REDACTED] RCX: 00007ff38d41f20c
[   73.567066] RDX: [PII_REDACTED] RSI: 00007fff3b945b30 RDI: [PII_REDACTED]
[   73.574457] RBP: [PII_REDACTED] R08: [PII_REDACTED] R09: [PII_REDACTED]
[   73.581852] R10: [PII_REDACTED] R11: [PII_REDACTED] R12: 00007fff3b945ab0
[   73.589179] R13: [PII_REDACTED] R14: [PII_REDACTED] R15: 00007fff3b945b30
[   73.596545]  </TASK>
[   73.598842] ---[ end trace [PII_REDACTED] ]---
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/2af944210dc23d43d8208dafac4df7be7e3c168b; https://git.kernel.org/stable/c/3f6a57ee8544ec3982f8a3cbcbf4aea7d47eb9ec; https://git.kernel.org/stable/c/68a0ed06dcd5d3ea732d011c0b83d66e4791f521