CVE-2022-48868

{"id": "CVE-2022-48868", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2024-08-21T07:15:04.020", "references": [{"url": "https://git.kernel.org/stable/c/0f150134dd795ffcd60b798a85ab737d8d010fb7", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/99dc4520b74e7ca8e9dc9abe37a0b10b49467960", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/b51b75f0604f17c0f6f3b6f68f1a521a5cc6b04f", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-476"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: Let probe fail when workqueue cannot be enabled\n\nThe workqueue is enabled when the appropriate driver is loaded and\ndisabled when the driver is removed. When the driver is removed it\nassumes that the workqueue was enabled successfully and proceeds to\nfree allocations made during workqueue enabling.\n\nFailure during workqueue enabling does not prevent the driver from\nbeing loaded. This is because the error path within drv_enable_wq()\nreturns success unless a second failure is encountered\nduring the error path. By returning success it is possible to load\nthe driver even if the workqueue cannot be enabled and\nallocations that do not exist are attempted to be freed during\ndriver remove.\n\nSome examples of problematic flows:\n(a)\n\n idxd_dmaengine_drv_probe() -> drv_enable_wq() -> idxd_wq_request_irq():\n In above flow, if idxd_wq_request_irq() fails then\n idxd_wq_unmap_portal() is called on error exit path, but\n drv_enable_wq() returns 0 because idxd_wq_disable() succeeds. The\n driver is thus loaded successfully.\n\n idxd_dmaengine_drv_remove()->drv_disable_wq()->idxd_wq_unmap_portal()\n Above flow on driver unload triggers the WARN in devm_iounmap() because\n the device resource has already been removed during error path of\n drv_enable_wq().\n\n(b)\n\n idxd_dmaengine_drv_probe() -> drv_enable_wq() -> idxd_wq_request_irq():\n In above flow, if idxd_wq_request_irq() fails then\n idxd_wq_init_percpu_ref() is never called to initialize the percpu\n counter, yet the driver loads successfully because drv_enable_wq()\n returns 0.\n\n idxd_dmaengine_drv_remove()->__idxd_wq_quiesce()->percpu_ref_kill():\n Above flow on driver unload triggers a BUG when attempting to drop the\n initial ref of the uninitialized percpu ref:\n BUG: kernel NULL pointer dereference, address: 0000000000000010\n\nFix the drv_enable_wq() error path by returning the original error that\nindicates failure of workqueue enabling. This ensures that the probe\nfails when an error is encountered and the driver remove paths are only\nattempted when the workqueue was enabled successfully."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: dmaengine: idxd: permite que la sonda falle cuando no se puede habilitar la cola de trabajo. La cola de trabajo se habilita cuando se carga el controlador apropiado y se deshabilita cuando se elimina el controlador. Cuando se elimina el controlador, se supone que la cola de trabajo se habilit\u00f3 correctamente y procede a liberar las asignaciones realizadas durante la habilitaci\u00f3n de la cola de trabajo. La falla durante la habilitaci\u00f3n de la cola de trabajo no impide que se cargue el controlador. Esto se debe a que la ruta de error dentro de drv_enable_wq() devuelve \u00e9xito a menos que se encuentre una segunda falla durante la ruta de error. Al devolver el \u00e9xito, es posible cargar el controlador incluso si no se puede habilitar la cola de trabajo y se intenta liberar las asignaciones que no existen durante la eliminaci\u00f3n del controlador. Algunos ejemplos de flujos problem\u00e1ticos: (a) idxd_dmaengine_drv_probe() -> drv_enable_wq() -> idxd_wq_request_irq(): en el flujo anterior, si idxd_wq_request_irq() falla, se llama a idxd_wq_unmap_portal() en la ruta de salida de error, pero drv_enable_wq() devuelve 0 porque idxd_wq_disable() tiene \u00e9xito. De este modo, el controlador se carga correctamente. idxd_dmaengine_drv_remove()->drv_disable_wq()->idxd_wq_unmap_portal() El flujo anterior al descargar el controlador activa la ADVERTENCIA en devm_iounmap() porque el recurso del dispositivo ya se elimin\u00f3 durante la ruta de error de drv_enable_wq(). (b) idxd_dmaengine_drv_probe() -> drv_enable_wq() -> idxd_wq_request_irq(): en el flujo anterior, si idxd_wq_request_irq() falla, nunca se llama a idxd_wq_init_percpu_ref() para inicializar el contador de percpu, pero el controlador se carga correctamente porque drv_enable_wq() devuelve 0 idxd_dmaengine_drv_remove()->__idxd_wq_quiesce()->percpu_ref_kill(): El flujo anterior en la descarga del controlador desencadena un ERROR al intentar eliminar la referencia inicial de la referencia percpu no inicializada: ERROR: desreferencia del puntero NULL del kernel, direcci\u00f3n: 0000000000000010 Corrija el drv_enable_wq(. ) ruta de error al devolver el error original que indica un error al habilitar la cola de trabajo. Esto garantiza que la sonda falle cuando se encuentre un error y que las rutas de eliminaci\u00f3n del controlador solo se intenten cuando la cola de trabajo se habilit\u00f3 correctamente."}], "lastModified": "2024-09-04T18:38:59.113", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B8218B10-56F1-42B3-B9DF-75A2D3864D3E", "versionEndExcluding": "5.15.90", "versionStartIncluding": "5.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A6AFE6C9-3F59-4711-B2CF-7D6682FF6BD0", "versionEndExcluding": "6.1.8", "versionStartIncluding": "5.16"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}