CVE-2022-48788

In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: fix possible use-after-free in transport error_recovery work While nvme_rdma_submit_async_event_work is checking the ctrl and queue state before preparing the AER command and scheduling io_work, in order to fully prevent a race where this check is not reliable the error recovery work must flush async_event_work before continuing to destroy the admin queue after setting the ctrl state to RESETTING such that there is no race .submit_async_event and the error recovery handler itself changing the ctrl state.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/324f5bdc52ecb6a6dadb31a62823ef8c709d1439	Patch
https://git.kernel.org/stable/c/5593f72d1922403c11749532e3a0aa4cf61414e9	Patch
https://git.kernel.org/stable/c/646952b2210f19e584d2bf9eb5d092abdca2fcc1	Patch
https://git.kernel.org/stable/c/b6bb1722f34bbdbabed27acdceaf585d300c5fd2	Patch
https://git.kernel.org/stable/c/d411b2a5da68b8a130c23097014434ac140a2ace	Patch
https://git.kernel.org/stable/c/ea86027ac467a055849c4945906f799e7f65ab99	Patch
https://git.kernel.org/stable/c/324f5bdc52ecb6a6dadb31a62823ef8c709d1439	Patch
https://git.kernel.org/stable/c/5593f72d1922403c11749532e3a0aa4cf61414e9	Patch
https://git.kernel.org/stable/c/646952b2210f19e584d2bf9eb5d092abdca2fcc1	Patch
https://git.kernel.org/stable/c/b6bb1722f34bbdbabed27acdceaf585d300c5fd2	Patch
https://git.kernel.org/stable/c/d411b2a5da68b8a130c23097014434ac140a2ace	Patch
https://git.kernel.org/stable/c/ea86027ac467a055849c4945906f799e7f65ab99	Patch

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

History

21 Nov 2024, 07:34

Type	Values Removed	Values Added
References	~~() https://git.kernel.org/stable/c/324f5bdc52ecb6a6dadb31a62823ef8c709d1439 - Patch~~	() https://git.kernel.org/stable/c/324f5bdc52ecb6a6dadb31a62823ef8c709d1439 - Patch
References	~~() https://git.kernel.org/stable/c/5593f72d1922403c11749532e3a0aa4cf61414e9 - Patch~~	() https://git.kernel.org/stable/c/5593f72d1922403c11749532e3a0aa4cf61414e9 - Patch
References	~~() https://git.kernel.org/stable/c/646952b2210f19e584d2bf9eb5d092abdca2fcc1 - Patch~~	() https://git.kernel.org/stable/c/646952b2210f19e584d2bf9eb5d092abdca2fcc1 - Patch
References	~~() https://git.kernel.org/stable/c/b6bb1722f34bbdbabed27acdceaf585d300c5fd2 - Patch~~	() https://git.kernel.org/stable/c/b6bb1722f34bbdbabed27acdceaf585d300c5fd2 - Patch
References	~~() https://git.kernel.org/stable/c/d411b2a5da68b8a130c23097014434ac140a2ace - Patch~~	() https://git.kernel.org/stable/c/d411b2a5da68b8a130c23097014434ac140a2ace - Patch
References	~~() https://git.kernel.org/stable/c/ea86027ac467a055849c4945906f799e7f65ab99 - Patch~~	() https://git.kernel.org/stable/c/ea86027ac467a055849c4945906f799e7f65ab99 - Patch

07 Aug 2024, 19:48

Type	Values Removed	Values Added
Summary		(es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nvme-rdma: soluciona el posible use-after-free en el transporte error_recovery work Mientras nvme_rdma_submit_async_event_work verifica el control y el estado de la cola antes de preparar el comando AER y programar io_work, para evitar completamente una ejecución donde esta verificación no es confiable, el trabajo de recuperación de errores debe eliminar async_event_work antes de continuar destruyendo la cola de administración después de configurar el estado de control en RESETTING de manera que no haya ejecución .submit_async_event y el propio controlador de recuperación de errores cambie el estado de control.
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.8
CPE		cpe:2.3:o:linux:linux_kernel::::::::
First Time		Linux Linux linux Kernel
CWE		CWE-416
References	~~() https://git.kernel.org/stable/c/324f5bdc52ecb6a6dadb31a62823ef8c709d1439 -~~	() https://git.kernel.org/stable/c/324f5bdc52ecb6a6dadb31a62823ef8c709d1439 - Patch
References	~~() https://git.kernel.org/stable/c/5593f72d1922403c11749532e3a0aa4cf61414e9 -~~	() https://git.kernel.org/stable/c/5593f72d1922403c11749532e3a0aa4cf61414e9 - Patch
References	~~() https://git.kernel.org/stable/c/646952b2210f19e584d2bf9eb5d092abdca2fcc1 -~~	() https://git.kernel.org/stable/c/646952b2210f19e584d2bf9eb5d092abdca2fcc1 - Patch
References	~~() https://git.kernel.org/stable/c/b6bb1722f34bbdbabed27acdceaf585d300c5fd2 -~~	() https://git.kernel.org/stable/c/b6bb1722f34bbdbabed27acdceaf585d300c5fd2 - Patch
References	~~() https://git.kernel.org/stable/c/d411b2a5da68b8a130c23097014434ac140a2ace -~~	() https://git.kernel.org/stable/c/d411b2a5da68b8a130c23097014434ac140a2ace - Patch
References	~~() https://git.kernel.org/stable/c/ea86027ac467a055849c4945906f799e7f65ab99 -~~	() https://git.kernel.org/stable/c/ea86027ac467a055849c4945906f799e7f65ab99 - Patch

16 Jul 2024, 12:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-07-16 12:15

Updated : 2024-11-21 07:34

NVD link : CVE-2022-48788

Mitre link : CVE-2022-48788

CVE.ORG link : CVE-2022-48788

JSON object : View

Products Affected

linux

linux_kernel

CWE

CWE-416

Use After Free

7.8 /10