CVE-2022-48887 (GCVE-0-2022-48887)

Vulnerability from cvelistv5 – Published: 2024-08-21 06:10 – Updated: 2025-05-04 08:25
VLAI?
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Remove rcu locks from user resources User resource lookups used rcu to avoid two extra atomics. Unfortunately the rcu paths were buggy and it was easy to make the driver crash by submitting command buffers from two different threads. Because the lookups never show up in performance profiles replace them with a regular spin lock which fixes the races in accesses to those shared resources. Fixes kernel oops'es in IGT's vmwgfx execution_buffer stress test and seen crashes with apps using shared resources.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: e14c02e6b6990e9f6ee18a214a22ac26bae1b25e , < 7ac9578e45b20e3f3c0c8eb71f5417a499a7226a (git)
Affected: e14c02e6b6990e9f6ee18a214a22ac26bae1b25e , < a309c7194e8a2f8bd4539b9449917913f6c2cd50 (git)
Create a notification for this product.
    Linux Linux Affected: 4.20
Unaffected: 0 , < 4.20 (semver)
Unaffected: 6.1.7 , ≤ 6.1.* (semver)
Unaffected: 6.2 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-48887",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:04:35.491654Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:32:51.743Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/vmwgfx/ttm_object.c",
            "drivers/gpu/drm/vmwgfx/ttm_object.h",
            "drivers/gpu/drm/vmwgfx/vmwgfx_bo.c",
            "drivers/gpu/drm/vmwgfx/vmwgfx_drv.h",
            "drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c",
            "drivers/gpu/drm/vmwgfx/vmwgfx_resource.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7ac9578e45b20e3f3c0c8eb71f5417a499a7226a",
              "status": "affected",
              "version": "e14c02e6b6990e9f6ee18a214a22ac26bae1b25e",
              "versionType": "git"
            },
            {
              "lessThan": "a309c7194e8a2f8bd4539b9449917913f6c2cd50",
              "status": "affected",
              "version": "e14c02e6b6990e9f6ee18a214a22ac26bae1b25e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/vmwgfx/ttm_object.c",
            "drivers/gpu/drm/vmwgfx/ttm_object.h",
            "drivers/gpu/drm/vmwgfx/vmwgfx_bo.c",
            "drivers/gpu/drm/vmwgfx/vmwgfx_drv.h",
            "drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c",
            "drivers/gpu/drm/vmwgfx/vmwgfx_resource.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.7",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: Remove rcu locks from user resources\n\nUser resource lookups used rcu to avoid two extra atomics. Unfortunately\nthe rcu paths were buggy and it was easy to make the driver crash by\nsubmitting command buffers from two different threads. Because the\nlookups never show up in performance profiles replace them with a\nregular spin lock which fixes the races in accesses to those shared\nresources.\n\nFixes kernel oops\u0027es in IGT\u0027s vmwgfx execution_buffer stress test and\nseen crashes with apps using shared resources."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T08:25:30.419Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7ac9578e45b20e3f3c0c8eb71f5417a499a7226a"
        },
        {
          "url": "https://git.kernel.org/stable/c/a309c7194e8a2f8bd4539b9449917913f6c2cd50"
        }
      ],
      "title": "drm/vmwgfx: Remove rcu locks from user resources",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48887",
    "datePublished": "2024-08-21T06:10:19.073Z",
    "dateReserved": "2024-08-21T06:06:23.290Z",
    "dateUpdated": "2025-05-04T08:25:30.419Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.20\", \"versionEndExcluding\": \"6.1.7\", \"matchCriteriaId\": \"2D63FB2D-B092-4364-B732-F4FD54A43619\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"FF501633-2F44-4913-A8EE-B021929F49F6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"2BDA597B-CAC1-4DF0-86F0-42E142C654E9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"725C78C9-12CE-406F-ABE8-0813A01D66E8\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/vmwgfx: Remove rcu locks from user resources\\n\\nUser resource lookups used rcu to avoid two extra atomics. Unfortunately\\nthe rcu paths were buggy and it was easy to make the driver crash by\\nsubmitting command buffers from two different threads. Because the\\nlookups never show up in performance profiles replace them with a\\nregular spin lock which fixes the races in accesses to those shared\\nresources.\\n\\nFixes kernel oops\u0027es in IGT\u0027s vmwgfx execution_buffer stress test and\\nseen crashes with apps using shared resources.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: drm/vmwgfx: elimina los bloqueos de rcu de los recursos del usuario. Las b\\u00fasquedas de recursos del usuario utilizaron rcu para evitar dos \\u00e1tomos adicionales. Desafortunadamente, las rutas de rcu ten\\u00edan errores y era f\\u00e1cil hacer que el controlador fallara al enviar b\\u00faferes de comando desde dos subprocesos diferentes. Debido a que las b\\u00fasquedas nunca aparecen en los perfiles de rendimiento, reempl\\u00e1celas con un bloqueo de giro normal que corrige las ejecuciones en los accesos a esos recursos compartidos. Corrige los fallos del kernel en la prueba de esfuerzo vmwgfxexecution_b\\u00fafer de IGT y los fallos observados en las aplicaciones que utilizan recursos compartidos.\"}]",
      "id": "CVE-2022-48887",
      "lastModified": "2024-09-06T14:55:46.460",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-08-21T07:15:05.143",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/7ac9578e45b20e3f3c0c8eb71f5417a499a7226a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/a309c7194e8a2f8bd4539b9449917913f6c2cd50\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-noinfo\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-48887\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-08-21T07:15:05.143\",\"lastModified\":\"2024-09-06T14:55:46.460\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/vmwgfx: Remove rcu locks from user resources\\n\\nUser resource lookups used rcu to avoid two extra atomics. Unfortunately\\nthe rcu paths were buggy and it was easy to make the driver crash by\\nsubmitting command buffers from two different threads. Because the\\nlookups never show up in performance profiles replace them with a\\nregular spin lock which fixes the races in accesses to those shared\\nresources.\\n\\nFixes kernel oops\u0027es in IGT\u0027s vmwgfx execution_buffer stress test and\\nseen crashes with apps using shared resources.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: drm/vmwgfx: elimina los bloqueos de rcu de los recursos del usuario. Las b\u00fasquedas de recursos del usuario utilizaron rcu para evitar dos \u00e1tomos adicionales. Desafortunadamente, las rutas de rcu ten\u00edan errores y era f\u00e1cil hacer que el controlador fallara al enviar b\u00faferes de comando desde dos subprocesos diferentes. Debido a que las b\u00fasquedas nunca aparecen en los perfiles de rendimiento, reempl\u00e1celas con un bloqueo de giro normal que corrige las ejecuciones en los accesos a esos recursos compartidos. Corrige los fallos del kernel en la prueba de esfuerzo vmwgfxexecution_b\u00fafer de IGT y los fallos observados en las aplicaciones que utilizan recursos compartidos.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"6.1.7\",\"matchCriteriaId\":\"2D63FB2D-B092-4364-B732-F4FD54A43619\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"FF501633-2F44-4913-A8EE-B021929F49F6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"2BDA597B-CAC1-4DF0-86F0-42E142C654E9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"725C78C9-12CE-406F-ABE8-0813A01D66E8\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/7ac9578e45b20e3f3c0c8eb71f5417a499a7226a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a309c7194e8a2f8bd4539b9449917913f6c2cd50\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-48887\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:04:35.491654Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:11.773Z\"}}], \"cna\": {\"title\": \"drm/vmwgfx: Remove rcu locks from user resources\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"e14c02e6b6990e9f6ee18a214a22ac26bae1b25e\", \"lessThan\": \"7ac9578e45b20e3f3c0c8eb71f5417a499a7226a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e14c02e6b6990e9f6ee18a214a22ac26bae1b25e\", \"lessThan\": \"a309c7194e8a2f8bd4539b9449917913f6c2cd50\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/gpu/drm/vmwgfx/ttm_object.c\", \"drivers/gpu/drm/vmwgfx/ttm_object.h\", \"drivers/gpu/drm/vmwgfx/vmwgfx_bo.c\", \"drivers/gpu/drm/vmwgfx/vmwgfx_drv.h\", \"drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c\", \"drivers/gpu/drm/vmwgfx/vmwgfx_resource.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.20\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.20\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.7\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.2\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/gpu/drm/vmwgfx/ttm_object.c\", \"drivers/gpu/drm/vmwgfx/ttm_object.h\", \"drivers/gpu/drm/vmwgfx/vmwgfx_bo.c\", \"drivers/gpu/drm/vmwgfx/vmwgfx_drv.h\", \"drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c\", \"drivers/gpu/drm/vmwgfx/vmwgfx_resource.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/7ac9578e45b20e3f3c0c8eb71f5417a499a7226a\"}, {\"url\": \"https://git.kernel.org/stable/c/a309c7194e8a2f8bd4539b9449917913f6c2cd50\"}], \"x_generator\": {\"engine\": \"bippy-5f407fcff5a0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/vmwgfx: Remove rcu locks from user resources\\n\\nUser resource lookups used rcu to avoid two extra atomics. Unfortunately\\nthe rcu paths were buggy and it was easy to make the driver crash by\\nsubmitting command buffers from two different threads. Because the\\nlookups never show up in performance profiles replace them with a\\nregular spin lock which fixes the races in accesses to those shared\\nresources.\\n\\nFixes kernel oops\u0027es in IGT\u0027s vmwgfx execution_buffer stress test and\\nseen crashes with apps using shared resources.\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-12-19T08:09:52.796Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-48887\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-12-19T08:09:52.796Z\", \"dateReserved\": \"2024-08-21T06:06:23.290Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-08-21T06:10:19.073Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.