[SRU][J][PATCH 0/1] CVE-2022-1205

[Cengiz Can]

https://ubuntu.com/security/CVE-2022-1205

[ Impact ]

A NULL pointer dereference flaw was found in the Linux kernel’s Amateur Radio
AX.25 protocol functionality in the way a user connects with the protocol. This
flaw allows a local user to crash the system.

[ Fix ]

jammy/linux: backported from 7d8a3a477b3e

The fix reworks AX.25 session cleanup in ax25_release() and ax25_disconnect().
It adds a device_up flag to ax25_dev so that del_timer_sync() is not called in
ax25_release() while sessions still need the timers to complete cleanup, deletes
the ax25_cb in ax25_kill_by_device() now that the timers may be stopped, reorders
the ax25_list_lock in ax25_cb_del() for synchronization, corrects the socket
check in ax25_disconnect() so incoming sessions with a NULL sk are cleaned up
properly, and avoids calling ax25_disconnect() twice by skipping it in
ax25_release() when the socket is already SOCK_DEAD.

[ Test Plan ]

Build and boot tested.

[ Where Problems Could Occur ]

A bad fix would affect systems that actually use the AX.25 amateur radio
protocol stack, such as amateur radio operators running packet radio over KISS
TNCs or similar AX.25 network devices; regressions could show up as stuck
sessions, incorrect socket states, or use-after-free issues around session
timers. Systems that do not load or use the AX.25 protocol are not affected.

[ Other Info ]

Kybele flow-v12-14-g7bcc3c7e. Reference: 0939f898/v1