Vulnerability: kernel/ucount.c in the Linux kernel 5.14 through 5.16.4, when unprivileged user namespaces are enabled, allows a use-after-free and privilege escalation because a ucounts object can outlive its namespace.
Vulnerability ID: CVE-2022-24122
CWE: CWE-416
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2022-01-29
File: kernel/ucount.c
Commit message: ucount:  Make get_ucount a safe get_user replacement

When the ucount code was refactored to create get_ucount it was missed
that some of the contexts in which a rlimit is kept elevated can be
the only reference to the user/ucount in the system.

Ordinary ucount references exist in places that also have a reference
to the user namspace, but in POSIX message queues, the SysV shm code,
and the SIGPENDING code there is no independent user namespace
reference.

Inspection of the the user_namespace show no instance of circular
references between struct ucounts and the user_namespace.  So
hold a reference from struct ucount to i's user_namespace to
resolve this problem.

Link: https://lore.kernel.org/lkml/YZV7Z+yXbsx9p3JN@fixkernel.com/
Reported-by: Qian Cai <quic_qiancai@quicinc.com>
Reported-by: Mathias Krause <minipli@grsecurity.net>
Tested-by: Mathias Krause <minipli@grsecurity.net>
Reviewed-by: Mathias Krause <minipli@grsecurity.net>
Reviewed-by: Alexey Gladkov <legion@kernel.org>
Fixes: d64696905554 ("Reimplement RLIMIT_SIGPENDING on top of ucounts")
Fixes: 6e52a9f0532f ("Reimplement RLIMIT_MSGQUEUE on top of ucounts")
Fixes: d7c9e99aee48 ("Reimplement RLIMIT_MEMLOCK on top of ucounts")
Cc: stable@vger.kernel.org
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Commit author: Eric W. Biederman

Vulnerable version (before fix):
 struct ucounts *alloc_ucounts(struct user_namespace *ns, kuid_t uid) 			kfree(new); 		} else { 			hlist_add_head(&new->node, hashent); 			spin_unlock_irq(&ucounts_lock); 			return new; 		} void put_ucounts(struct ucounts *ucounts) 	if (atomic_dec_and_lock_irqsave(&ucounts->count, &ucounts_lock, flags)) { 		hlist_del_init(&ucounts->node); 		spin_unlock_irqrestore(&ucounts_lock, flags); 		kfree(ucounts); 	} }

Fixed version (after fix):
 struct ucounts *alloc_ucounts(struct user_namespace *ns, kuid_t uid) 			kfree(new); 		} else { 			hlist_add_head(&new->node, hashent); 			get_user_ns(new->ns); 			spin_unlock_irq(&ucounts_lock); 			return new; 		} void put_ucounts(struct ucounts *ucounts) 	if (atomic_dec_and_lock_irqsave(&ucounts->count, &ucounts_lock, flags)) { 		hlist_del_init(&ucounts->node); 		spin_unlock_irqrestore(&ucounts_lock, flags); 		put_user_ns(ucounts->ns); 		kfree(ucounts); 	} }

Patch:
patch: @@ -190,6 +190,7 @@ struct ucounts *alloc_ucounts(struct user_namespace *ns, kuid_t uid)
 			kfree(new);
 		} else {
 			hlist_add_head(&new->node, hashent);
+			get_user_ns(new->ns);
 			spin_unlock_irq(&ucounts_lock);
 			return new;
 		}
@@ -210,6 +211,7 @@ void put_ucounts(struct ucounts *ucounts)
 	if (atomic_dec_and_lock_irqsave(&ucounts->count, &ucounts_lock, flags)) {
 		hlist_del_init(&ucounts->node);
 		spin_unlock_irqrestore(&ucounts_lock, flags);
+		put_user_ns(ucounts->ns);
 		kfree(ucounts);
 	}
 }
path: kernel/ucount.c