CVE-2022-48789

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix possible use-after-free in transport error_recovery work While nvme_tcp_submit_async_event_work is checking the ctrl and queue state before preparing the AER command and scheduling io_work, in order to fully prevent a race where this check is not reliable the error recovery work must flush async_event_work before continuing to destroy the admin queue after setting the ctrl state to RESETTING such that there is no race .submit_async_event and the error recovery handler itself changing the ctrl state.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/5e42fca37ccc76f39f73732661bd47254cad5982	Patch
https://git.kernel.org/stable/c/61a26ffd5ad3ece456d74c4c79f7b5e3f440a141	Patch
https://git.kernel.org/stable/c/bb0d8fb35c4ff00a503c2c4dca4cce8d102a21c4	Patch
https://git.kernel.org/stable/c/e192184cf8bce8dd55d619f5611a2eaba996fa05	Patch
https://git.kernel.org/stable/c/ff9fc7ebf5c06de1ef72a69f9b1ab40af8b07f9e	Patch
https://git.kernel.org/stable/c/5e42fca37ccc76f39f73732661bd47254cad5982	Patch
https://git.kernel.org/stable/c/61a26ffd5ad3ece456d74c4c79f7b5e3f440a141	Patch
https://git.kernel.org/stable/c/bb0d8fb35c4ff00a503c2c4dca4cce8d102a21c4	Patch
https://git.kernel.org/stable/c/e192184cf8bce8dd55d619f5611a2eaba996fa05	Patch
https://git.kernel.org/stable/c/ff9fc7ebf5c06de1ef72a69f9b1ab40af8b07f9e	Patch

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

History

21 Nov 2024, 07:34

Type	Values Removed	Values Added
References	~~() https://git.kernel.org/stable/c/5e42fca37ccc76f39f73732661bd47254cad5982 - Patch~~	() https://git.kernel.org/stable/c/5e42fca37ccc76f39f73732661bd47254cad5982 - Patch
References	~~() https://git.kernel.org/stable/c/61a26ffd5ad3ece456d74c4c79f7b5e3f440a141 - Patch~~	() https://git.kernel.org/stable/c/61a26ffd5ad3ece456d74c4c79f7b5e3f440a141 - Patch
References	~~() https://git.kernel.org/stable/c/bb0d8fb35c4ff00a503c2c4dca4cce8d102a21c4 - Patch~~	() https://git.kernel.org/stable/c/bb0d8fb35c4ff00a503c2c4dca4cce8d102a21c4 - Patch
References	~~() https://git.kernel.org/stable/c/e192184cf8bce8dd55d619f5611a2eaba996fa05 - Patch~~	() https://git.kernel.org/stable/c/e192184cf8bce8dd55d619f5611a2eaba996fa05 - Patch
References	~~() https://git.kernel.org/stable/c/ff9fc7ebf5c06de1ef72a69f9b1ab40af8b07f9e - Patch~~	() https://git.kernel.org/stable/c/ff9fc7ebf5c06de1ef72a69f9b1ab40af8b07f9e - Patch

07 Aug 2024, 20:06

Type	Values Removed	Values Added
Summary		(es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nvme-tcp: soluciona el posible use-after-free en el transporte error_recovery work Mientras nvme_tcp_submit_async_event_work verifica el control y el estado de la cola antes de preparar el comando AER y programar io_work, para evitar completamente una ejecución donde esta verificación no es confiable, el trabajo de recuperación de errores debe eliminar async_event_work antes de continuar destruyendo la cola de administración después de configurar el estado de control en RESETTING de manera que no haya ejecución .submit_async_event y el propio controlador de recuperación de errores cambie el estado de control.
References	~~() https://git.kernel.org/stable/c/5e42fca37ccc76f39f73732661bd47254cad5982 -~~	() https://git.kernel.org/stable/c/5e42fca37ccc76f39f73732661bd47254cad5982 - Patch
References	~~() https://git.kernel.org/stable/c/61a26ffd5ad3ece456d74c4c79f7b5e3f440a141 -~~	() https://git.kernel.org/stable/c/61a26ffd5ad3ece456d74c4c79f7b5e3f440a141 - Patch
References	~~() https://git.kernel.org/stable/c/bb0d8fb35c4ff00a503c2c4dca4cce8d102a21c4 -~~	() https://git.kernel.org/stable/c/bb0d8fb35c4ff00a503c2c4dca4cce8d102a21c4 - Patch
References	~~() https://git.kernel.org/stable/c/e192184cf8bce8dd55d619f5611a2eaba996fa05 -~~	() https://git.kernel.org/stable/c/e192184cf8bce8dd55d619f5611a2eaba996fa05 - Patch
References	~~() https://git.kernel.org/stable/c/ff9fc7ebf5c06de1ef72a69f9b1ab40af8b07f9e -~~	() https://git.kernel.org/stable/c/ff9fc7ebf5c06de1ef72a69f9b1ab40af8b07f9e - Patch
CPE		cpe:2.3:o:linux:linux_kernel::::::::
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.8
First Time		Linux Linux linux Kernel
CWE		CWE-416

16 Jul 2024, 12:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-07-16 12:15

Updated : 2024-11-21 07:34

NVD link : CVE-2022-48789

Mitre link : CVE-2022-48789

CVE.ORG link : CVE-2022-48789

JSON object : View

Products Affected

linux

linux_kernel

CWE

CWE-416

Use After Free

7.8 /10