CVE-2022-3028: 
Linux Kernel vulnerability analysis and mitigation

A race condition was discovered in the Linux kernel's IP framework for transforming packets (XFRM subsystem) when multiple calls to xfrm_probe_algs occurred simultaneously. The vulnerability, identified as CVE-2022-3028, was reported by Abhishek Shah and affects Linux kernel versions prior to 6.0. The issue was introduced by commit 283bc9f35bbb which added namespace support to xfrm/afkey (Kernel Commit).

The vulnerability stems from a race condition in the AF_KEY subsystem where previously single-threaded calls to xfrm_probe_algs became multi-threaded after namespace support was added. This occurs specifically when multiple calls to xfrm_probe_algs happen simultaneously during the execution of compose_sadb_supported. The issue has a CVSS 3.1 score of 7.0 (HIGH) with the vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (NetApp Advisory).

This flaw could allow a local attacker to potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read and copying it into a socket. If an algorithm was added during the racing access, the code allocates a buffer that is smaller than the number of available algorithms, resulting in an out-of-bounds write when the buffer is later populated (Kernel Discussion).

The vulnerability requires local access and high complexity to exploit. A local attacker could potentially exploit this vulnerability to cause a denial of service (crash or memory corruption), obtain sensitive information, or possibly achieve privilege escalation (CVE Mitre).

The issue was fixed by adding a mutex lock around the xfrm_probe_algs call in the pfkey_register function. The fix was implemented in Linux kernel version 6.0-rc3 through commit ba953a9d89a00c078b85f4b190bc1dde66fe16b5. Various Linux distributions have backported this fix to their supported kernel versions (Ubuntu Security).