CVE-2022-48649
Vulnerability from cvelistv5
Published
2024-04-28 13:00
Modified
2024-12-19 08:05
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: mm/slab_common: fix possible double free of kmem_cache When doing slub_debug test, kfence's 'test_memcache_typesafe_by_rcu' kunit test case cause a use-after-free error: BUG: KASAN: use-after-free in kobject_del+0x14/0x30 Read of size 8 at addr ffff888007679090 by task kunit_try_catch/261 CPU: 1 PID: 261 Comm: kunit_try_catch Tainted: G B N 6.0.0-rc5-next-20220916 #17 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x34/0x48 print_address_description.constprop.0+0x87/0x2a5 print_report+0x103/0x1ed kasan_report+0xb7/0x140 kobject_del+0x14/0x30 kmem_cache_destroy+0x130/0x170 test_exit+0x1a/0x30 kunit_try_run_case+0xad/0xc0 kunit_generic_run_threadfn_adapter+0x26/0x50 kthread+0x17b/0x1b0 </TASK> The cause is inside kmem_cache_destroy(): kmem_cache_destroy acquire lock/mutex shutdown_cache schedule_work(kmem_cache_release) (if RCU flag set) release lock/mutex kmem_cache_release (if RCU flag not set) In some certain timing, the scheduled work could be run before the next RCU flag checking, which can then get a wrong value and lead to double kmem_cache_release(). Fix it by caching the RCU flag inside protected area, just like 'refcnt'
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/c673c6ceac53fb2e631c9fbbd79957099a08927f
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d71608a877362becdc94191f190902fac1e64d35
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/c673c6ceac53fb2e631c9fbbd79957099a08927f
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/d71608a877362becdc94191f190902fac1e64d35
Impacted products
Vendor Product Version
Linux Linux Version: 5.19.8   ≤
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T15:17:55.556Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c673c6ceac53fb2e631c9fbbd79957099a08927f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d71608a877362becdc94191f190902fac1e64d35"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-48649",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:46:11.220120Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:10.427Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/slab_common.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c673c6ceac53fb2e631c9fbbd79957099a08927f",
              "status": "affected",
              "version": "357321557920c805de2b14832002465c320eea4f",
              "versionType": "git"
            },
            {
              "lessThan": "d71608a877362becdc94191f190902fac1e64d35",
              "status": "affected",
              "version": "0495e337b7039191dfce6e03f5f830454b1fae6b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/slab_common.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5.19.12",
              "status": "affected",
              "version": "5.19.8",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/slab_common: fix possible double free of kmem_cache\n\nWhen doing slub_debug test, kfence\u0027s \u0027test_memcache_typesafe_by_rcu\u0027\nkunit test case cause a use-after-free error:\n\n  BUG: KASAN: use-after-free in kobject_del+0x14/0x30\n  Read of size 8 at addr ffff888007679090 by task kunit_try_catch/261\n\n  CPU: 1 PID: 261 Comm: kunit_try_catch Tainted: G    B            N 6.0.0-rc5-next-20220916 #17\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\n  Call Trace:\n   \u003cTASK\u003e\n   dump_stack_lvl+0x34/0x48\n   print_address_description.constprop.0+0x87/0x2a5\n   print_report+0x103/0x1ed\n   kasan_report+0xb7/0x140\n   kobject_del+0x14/0x30\n   kmem_cache_destroy+0x130/0x170\n   test_exit+0x1a/0x30\n   kunit_try_run_case+0xad/0xc0\n   kunit_generic_run_threadfn_adapter+0x26/0x50\n   kthread+0x17b/0x1b0\n   \u003c/TASK\u003e\n\nThe cause is inside kmem_cache_destroy():\n\nkmem_cache_destroy\n    acquire lock/mutex\n    shutdown_cache\n        schedule_work(kmem_cache_release) (if RCU flag set)\n    release lock/mutex\n    kmem_cache_release (if RCU flag not set)\n\nIn some certain timing, the scheduled work could be run before\nthe next RCU flag checking, which can then get a wrong value\nand lead to double kmem_cache_release().\n\nFix it by caching the RCU flag inside protected area, just like \u0027refcnt\u0027"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-19T08:05:02.082Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c673c6ceac53fb2e631c9fbbd79957099a08927f"
        },
        {
          "url": "https://git.kernel.org/stable/c/d71608a877362becdc94191f190902fac1e64d35"
        }
      ],
      "title": "mm/slab_common: fix possible double free of kmem_cache",
      "x_generator": {
        "engine": "bippy-5f407fcff5a0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48649",
    "datePublished": "2024-04-28T13:00:33.390Z",
    "dateReserved": "2024-02-25T13:44:28.316Z",
    "dateUpdated": "2024-12-19T08:05:02.082Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-48649\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-04-28T13:15:07.333\",\"lastModified\":\"2024-11-21T07:33:41.463\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm/slab_common: fix possible double free of kmem_cache\\n\\nWhen doing slub_debug test, kfence\u0027s \u0027test_memcache_typesafe_by_rcu\u0027\\nkunit test case cause a use-after-free error:\\n\\n  BUG: KASAN: use-after-free in kobject_del+0x14/0x30\\n  Read of size 8 at addr ffff888007679090 by task kunit_try_catch/261\\n\\n  CPU: 1 PID: 261 Comm: kunit_try_catch Tainted: G    B            N 6.0.0-rc5-next-20220916 #17\\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\\n  Call Trace:\\n   \u003cTASK\u003e\\n   dump_stack_lvl+0x34/0x48\\n   print_address_description.constprop.0+0x87/0x2a5\\n   print_report+0x103/0x1ed\\n   kasan_report+0xb7/0x140\\n   kobject_del+0x14/0x30\\n   kmem_cache_destroy+0x130/0x170\\n   test_exit+0x1a/0x30\\n   kunit_try_run_case+0xad/0xc0\\n   kunit_generic_run_threadfn_adapter+0x26/0x50\\n   kthread+0x17b/0x1b0\\n   \u003c/TASK\u003e\\n\\nThe cause is inside kmem_cache_destroy():\\n\\nkmem_cache_destroy\\n    acquire lock/mutex\\n    shutdown_cache\\n        schedule_work(kmem_cache_release) (if RCU flag set)\\n    release lock/mutex\\n    kmem_cache_release (if RCU flag not set)\\n\\nIn some certain timing, the scheduled work could be run before\\nthe next RCU flag checking, which can then get a wrong value\\nand lead to double kmem_cache_release().\\n\\nFix it by caching the RCU flag inside protected area, just like \u0027refcnt\u0027\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mm/slab_common: correcci\u00f3n posible doble liberaci\u00f3n de kmem_cache Al realizar la prueba slub_debug, el caso de prueba kunit \u0027test_memcache_typesafe_by_rcu\u0027 de kfence causa un error de use-after-free: ERROR: KASAN: uso despu\u00e9s -free en kobject_del+0x14/0x30 Lectura de tama\u00f1o 8 en addr ffff888007679090 por tarea kunit_try_catch/261 CPU: 1 PID: 261 Comm: kunit_try_catch Contaminado: GBN 6.0.0-rc5-next-20220916 #17 Nombre de hardware: PC est\u00e1ndar QEMU ( I440FX+PIIX, 1996), BIOS 1.15.0-1 04/01/2014 TRACE DE LLAMADA:  dump_stack_lvl+0x34/0x48 print_address_description.constprop.0+0x87/0x2a5 print_rePort+0x103/0x1ed kasan_report+0xb7/0x140/0x140/0x140+0xb7/0x140/0x140/0x140/0x14/0x140/0xil 0x14/0x30 kmem_cache_destroy+0x130/0x170 test_exit+0x1a/0x30 kunit_try_run_case+0xad/0xc0 kunit_generic_run_threadfn_adapter+0x26/0x50 kthread+0x17b/0x1b0  La causa est\u00e1 dentro de kmem_cache_destroy (): kmem_cache_destroy adquirir bloqueo/mutex Shutdown_cache Schedule_work(kmem_cache_release) (si el indicador RCU est\u00e1 establecido) liberar bloqueo/mutex kmem_cache_release (si el indicador RCU no est\u00e1 establecido) En un momento determinado, el trabajo programado podr\u00eda ejecutarse antes de la siguiente verificaci\u00f3n del indicador RCU, lo que luego puede obtener un valor incorrecto y provocar un doble kmem_cache_release() . Solucionarlo almacenando en cach\u00e9 la bandera RCU dentro del \u00e1rea protegida, como \u0027refcnt\u0027\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/c673c6ceac53fb2e631c9fbbd79957099a08927f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d71608a877362becdc94191f190902fac1e64d35\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c673c6ceac53fb2e631c9fbbd79957099a08927f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/d71608a877362becdc94191f190902fac1e64d35\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.