CVE-2022-48969 (GCVE-0-2022-48969)

Vulnerability from cvelistv5 – Published: 2024-10-21 20:05 – Updated: 2026-05-11 18:50
VLAI?
Title
xen-netfront: Fix NULL sring after live migration
Summary
In the Linux kernel, the following vulnerability has been resolved: xen-netfront: Fix NULL sring after live migration A NAPI is setup for each network sring to poll data to kernel The sring with source host is destroyed before live migration and new sring with target host is setup after live migration. The NAPI for the old sring is not deleted until setup new sring with target host after migration. With busy_poll/busy_read enabled, the NAPI can be polled before got deleted when resume VM. BUG: unable to handle kernel NULL pointer dereference at 0000000000000008 IP: xennet_poll+0xae/0xd20 PGD 0 P4D 0 Oops: 0000 [#1] SMP PTI Call Trace: finish_task_switch+0x71/0x230 timerqueue_del+0x1d/0x40 hrtimer_try_to_cancel+0xb5/0x110 xennet_alloc_rx_buffers+0x2a0/0x2a0 napi_busy_loop+0xdb/0x270 sock_poll+0x87/0x90 do_sys_poll+0x26f/0x580 tracing_map_insert+0x1d4/0x2f0 event_hist_trigger+0x14a/0x260 finish_task_switch+0x71/0x230 __schedule+0x256/0x890 recalc_sigpending+0x1b/0x50 xen_sched_clock+0x15/0x20 __rb_reserve_next+0x12d/0x140 ring_buffer_lock_reserve+0x123/0x3d0 event_triggers_call+0x87/0xb0 trace_event_buffer_commit+0x1c4/0x210 xen_clocksource_get_cycles+0x15/0x20 ktime_get_ts64+0x51/0xf0 SyS_ppoll+0x160/0x1a0 SyS_ppoll+0x160/0x1a0 do_syscall_64+0x73/0x130 entry_SYSCALL_64_after_hwframe+0x41/0xa6 ... RIP: xennet_poll+0xae/0xd20 RSP: ffffb4f041933900 CR2: 0000000000000008 ---[ end trace f8601785b354351c ]--- xen frontend should remove the NAPIs for the old srings before live migration as the bond srings are destroyed There is a tiny window between the srings are set to NULL and the NAPIs are disabled, It is safe as the NAPI threads are still frozen at that time
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 4ec2411980d0fd2995e8dea8a06fe57aa47523cb , < 99859947517e446058ad7243ee81d2f9801fa3dd (git)
Affected: 4ec2411980d0fd2995e8dea8a06fe57aa47523cb , < ed773dd798bf720756d20021b8d8a4a3d7184bda (git)
Affected: 4ec2411980d0fd2995e8dea8a06fe57aa47523cb , < e6860c889f4ad50b6ab696f5ea154295d72cf27a (git)
Affected: 4ec2411980d0fd2995e8dea8a06fe57aa47523cb , < e6e897d4fe2f89c0bd94600a40bedf5e6e75e050 (git)
Affected: 4ec2411980d0fd2995e8dea8a06fe57aa47523cb , < f2dd60fd3fe98bd36a91b0c6e10bfe9d66258f84 (git)
Affected: 4ec2411980d0fd2995e8dea8a06fe57aa47523cb , < d50b7914fae04d840ce36491d22133070b18cca9 (git)
Create a notification for this product.
Linux Linux Affected: 2.6.24
Unaffected: 0 , < 2.6.24 (semver)
Unaffected: 4.19.269 , ≤ 4.19.* (semver)
Unaffected: 5.4.227 , ≤ 5.4.* (semver)
Unaffected: 5.10.159 , ≤ 5.10.* (semver)
Unaffected: 5.15.83 , ≤ 5.15.* (semver)
Unaffected: 6.0.13 , ≤ 6.0.* (semver)
Unaffected: 6.1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-48969",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-22T13:19:22.834399Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-22T13:28:38.112Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/xen-netfront.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "99859947517e446058ad7243ee81d2f9801fa3dd",
              "status": "affected",
              "version": "4ec2411980d0fd2995e8dea8a06fe57aa47523cb",
              "versionType": "git"
            },
            {
              "lessThan": "ed773dd798bf720756d20021b8d8a4a3d7184bda",
              "status": "affected",
              "version": "4ec2411980d0fd2995e8dea8a06fe57aa47523cb",
              "versionType": "git"
            },
            {
              "lessThan": "e6860c889f4ad50b6ab696f5ea154295d72cf27a",
              "status": "affected",
              "version": "4ec2411980d0fd2995e8dea8a06fe57aa47523cb",
              "versionType": "git"
            },
            {
              "lessThan": "e6e897d4fe2f89c0bd94600a40bedf5e6e75e050",
              "status": "affected",
              "version": "4ec2411980d0fd2995e8dea8a06fe57aa47523cb",
              "versionType": "git"
            },
            {
              "lessThan": "f2dd60fd3fe98bd36a91b0c6e10bfe9d66258f84",
              "status": "affected",
              "version": "4ec2411980d0fd2995e8dea8a06fe57aa47523cb",
              "versionType": "git"
            },
            {
              "lessThan": "d50b7914fae04d840ce36491d22133070b18cca9",
              "status": "affected",
              "version": "4ec2411980d0fd2995e8dea8a06fe57aa47523cb",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/xen-netfront.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.24"
            },
            {
              "lessThan": "2.6.24",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.269",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.227",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.159",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.83",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.269",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.227",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.159",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.83",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.13",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen-netfront: Fix NULL sring after live migration\n\nA NAPI is setup for each network sring to poll data to kernel\nThe sring with source host is destroyed before live migration and\nnew sring with target host is setup after live migration.\nThe NAPI for the old sring is not deleted until setup new sring\nwith target host after migration. With busy_poll/busy_read enabled,\nthe NAPI can be polled before got deleted when resume VM.\n\nBUG: unable to handle kernel NULL pointer dereference at\n0000000000000008\nIP: xennet_poll+0xae/0xd20\nPGD 0 P4D 0\nOops: 0000 [#1] SMP PTI\nCall Trace:\n finish_task_switch+0x71/0x230\n timerqueue_del+0x1d/0x40\n hrtimer_try_to_cancel+0xb5/0x110\n xennet_alloc_rx_buffers+0x2a0/0x2a0\n napi_busy_loop+0xdb/0x270\n sock_poll+0x87/0x90\n do_sys_poll+0x26f/0x580\n tracing_map_insert+0x1d4/0x2f0\n event_hist_trigger+0x14a/0x260\n\n finish_task_switch+0x71/0x230\n __schedule+0x256/0x890\n recalc_sigpending+0x1b/0x50\n xen_sched_clock+0x15/0x20\n __rb_reserve_next+0x12d/0x140\n ring_buffer_lock_reserve+0x123/0x3d0\n event_triggers_call+0x87/0xb0\n trace_event_buffer_commit+0x1c4/0x210\n xen_clocksource_get_cycles+0x15/0x20\n ktime_get_ts64+0x51/0xf0\n SyS_ppoll+0x160/0x1a0\n SyS_ppoll+0x160/0x1a0\n do_syscall_64+0x73/0x130\n entry_SYSCALL_64_after_hwframe+0x41/0xa6\n...\nRIP: xennet_poll+0xae/0xd20 RSP: ffffb4f041933900\nCR2: 0000000000000008\n---[ end trace f8601785b354351c ]---\n\nxen frontend should remove the NAPIs for the old srings before live\nmigration as the bond srings are destroyed\n\nThere is a tiny window between the srings are set to NULL and\nthe NAPIs are disabled, It is safe as the NAPI threads are still\nfrozen at that time"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T18:50:39.846Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/99859947517e446058ad7243ee81d2f9801fa3dd"
        },
        {
          "url": "https://git.kernel.org/stable/c/ed773dd798bf720756d20021b8d8a4a3d7184bda"
        },
        {
          "url": "https://git.kernel.org/stable/c/e6860c889f4ad50b6ab696f5ea154295d72cf27a"
        },
        {
          "url": "https://git.kernel.org/stable/c/e6e897d4fe2f89c0bd94600a40bedf5e6e75e050"
        },
        {
          "url": "https://git.kernel.org/stable/c/f2dd60fd3fe98bd36a91b0c6e10bfe9d66258f84"
        },
        {
          "url": "https://git.kernel.org/stable/c/d50b7914fae04d840ce36491d22133070b18cca9"
        }
      ],
      "title": "xen-netfront: Fix NULL sring after live migration",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48969",
    "datePublished": "2024-10-21T20:05:51.051Z",
    "dateReserved": "2024-08-22T01:27:53.629Z",
    "dateUpdated": "2026-05-11T18:50:39.846Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-48969",
      "date": "2026-05-21",
      "epss": "0.00011",
      "percentile": "0.01476"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"2.6.24\", \"versionEndExcluding\": \"4.19.269\", \"matchCriteriaId\": \"15C7931B-DA37-4374-B1A0-AE4E0F69FB92\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.20\", \"versionEndExcluding\": \"5.4.227\", \"matchCriteriaId\": \"8C752145-904B-474A-A7F2-E9F29353B0FE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.5\", \"versionEndExcluding\": \"5.10.159\", \"matchCriteriaId\": \"7318B597-DFFD-4BBC-A947-539D6E30D82A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.11\", \"versionEndExcluding\": \"5.15.83\", \"matchCriteriaId\": \"90897BD1-104D-4CFF-94F5-29F9041217FB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.16\", \"versionEndExcluding\": \"6.0.13\", \"matchCriteriaId\": \"389392A7-81C4-4C26-884B-8C7CF0F53DA4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"E7E331DA-1FB0-4DEC-91AC-7DA69D461C11\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"17F0B248-42CF-4AE6-A469-BB1BAE7F4705\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"E2422816-0C14-4B5E-A1E6-A9D776E5C49B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*\", \"matchCriteriaId\": \"1C6E00FE-5FB9-4D20-A1A1-5A32128F9B76\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.1:rc5:*:*:*:*:*:*\", \"matchCriteriaId\": \"35B26BE4-43A6-4A36-A7F6-5B3F572D9186\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.1:rc6:*:*:*:*:*:*\", \"matchCriteriaId\": \"3FFFB0B3-930D-408A-91E2-BAE0C2715D80\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.1:rc7:*:*:*:*:*:*\", \"matchCriteriaId\": \"8535320E-A0DB-4277-800E-D0CE5BBA59E8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.1:rc8:*:*:*:*:*:*\", \"matchCriteriaId\": \"21718AA4-4056-40F2-968E-BDAA465A7872\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nxen-netfront: Fix NULL sring after live migration\\n\\nA NAPI is setup for each network sring to poll data to kernel\\nThe sring with source host is destroyed before live migration and\\nnew sring with target host is setup after live migration.\\nThe NAPI for the old sring is not deleted until setup new sring\\nwith target host after migration. With busy_poll/busy_read enabled,\\nthe NAPI can be polled before got deleted when resume VM.\\n\\nBUG: unable to handle kernel NULL pointer dereference at\\n0000000000000008\\nIP: xennet_poll+0xae/0xd20\\nPGD 0 P4D 0\\nOops: 0000 [#1] SMP PTI\\nCall Trace:\\n finish_task_switch+0x71/0x230\\n timerqueue_del+0x1d/0x40\\n hrtimer_try_to_cancel+0xb5/0x110\\n xennet_alloc_rx_buffers+0x2a0/0x2a0\\n napi_busy_loop+0xdb/0x270\\n sock_poll+0x87/0x90\\n do_sys_poll+0x26f/0x580\\n tracing_map_insert+0x1d4/0x2f0\\n event_hist_trigger+0x14a/0x260\\n\\n finish_task_switch+0x71/0x230\\n __schedule+0x256/0x890\\n recalc_sigpending+0x1b/0x50\\n xen_sched_clock+0x15/0x20\\n __rb_reserve_next+0x12d/0x140\\n ring_buffer_lock_reserve+0x123/0x3d0\\n event_triggers_call+0x87/0xb0\\n trace_event_buffer_commit+0x1c4/0x210\\n xen_clocksource_get_cycles+0x15/0x20\\n ktime_get_ts64+0x51/0xf0\\n SyS_ppoll+0x160/0x1a0\\n SyS_ppoll+0x160/0x1a0\\n do_syscall_64+0x73/0x130\\n entry_SYSCALL_64_after_hwframe+0x41/0xa6\\n...\\nRIP: xennet_poll+0xae/0xd20 RSP: ffffb4f041933900\\nCR2: 0000000000000008\\n---[ end trace f8601785b354351c ]---\\n\\nxen frontend should remove the NAPIs for the old srings before live\\nmigration as the bond srings are destroyed\\n\\nThere is a tiny window between the srings are set to NULL and\\nthe NAPIs are disabled, It is safe as the NAPI threads are still\\nfrozen at that time\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: xen-netfront: Reparar sring NULL despu\\u00e9s de la migraci\\u00f3n en vivo Se configura un NAPI para cada sring de red para sondear los datos al kernel El sring con el host de origen se destruye antes de la migraci\\u00f3n en vivo y se configura el nuevo sring con el host de destino despu\\u00e9s de la migraci\\u00f3n en vivo. El NAPI para el sring antiguo no se elimina hasta que se configura el nuevo sring con el host de destino despu\\u00e9s de la migraci\\u00f3n. Con busy_poll/busy_read habilitado, el NAPI se puede sondear antes de que se elimine cuando se reanuda la VM. ERROR: no se puede manejar la desreferencia del puntero NULL del n\\u00facleo en 0000000000000008 IP: xennet_poll+0xae/0xd20 PGD 0 P4D 0 Oops: 0000 [#1] Seguimiento de llamadas PTI de SMP: finish_task_switch+0x71/0x230 timerqueue_del+0x1d/0x40 hrtimer_try_to_cancel+0xb5/0x110 xennet_alloc_rx_buffers+0x2a0/0x2a0 napi_busy_loop+0xdb/0x270 sock_poll+0x87/0x90 do_sys_poll+0x26f/0x580 tracing_map_insert+0x1d4/0x2f0 evento_hist_trigger+0x14a/0x260 finalizar_cambio_tarea+0x71/0x230 __schedule+0x256/0x890 recalc_sigping+0x1b/0x50 xen_sched_clock+0x15/0x20 __rb_reserve_next+0x12d/0x140 reserva_bloqueo_buffer_anillo+0x123/0x3d0 llamada_activadores_evento+0x87/0xb0 confirmaci\\u00f3n_buffer_evento_trace+0x1c4/0x210 xen_clocksource_get_cycles+0x15/0x20 ktime_get_ts64+0x51/0xf0 SyS_ppoll+0x160/0x1a0 SyS_ppoll+0x160/0x1a0 do_syscall_64+0x73/0x130 entry_SYSCALL_64_after_hwframe+0x41/0xa6 ... RIP: xennet_poll+0xae/0xd20 RSP: ffffb4f041933900 CR2: 0000000000000008 ---[ fin del seguimiento f8601785b354351c ]--- la interfaz de xen debe eliminar las NAPI de los antiguos srings antes de la migraci\\u00f3n en vivo, ya que los srings de enlace se destruyen. Hay una peque\\u00f1a ventana entre los srings que se establecen en NULL y los NAPI que se deshabilitan. Es seguro ya que los subprocesos NAPI todav\\u00eda est\\u00e1n congelados en ese momento.\"}]",
      "id": "CVE-2022-48969",
      "lastModified": "2024-10-25T21:22:10.087",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-10-21T20:15:09.037",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/99859947517e446058ad7243ee81d2f9801fa3dd\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/d50b7914fae04d840ce36491d22133070b18cca9\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/e6860c889f4ad50b6ab696f5ea154295d72cf27a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/e6e897d4fe2f89c0bd94600a40bedf5e6e75e050\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/ed773dd798bf720756d20021b8d8a4a3d7184bda\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/f2dd60fd3fe98bd36a91b0c6e10bfe9d66258f84\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-476\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-48969\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-10-21T20:15:09.037\",\"lastModified\":\"2024-10-25T21:22:10.087\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nxen-netfront: Fix NULL sring after live migration\\n\\nA NAPI is setup for each network sring to poll data to kernel\\nThe sring with source host is destroyed before live migration and\\nnew sring with target host is setup after live migration.\\nThe NAPI for the old sring is not deleted until setup new sring\\nwith target host after migration. With busy_poll/busy_read enabled,\\nthe NAPI can be polled before got deleted when resume VM.\\n\\nBUG: unable to handle kernel NULL pointer dereference at\\n0000000000000008\\nIP: xennet_poll+0xae/0xd20\\nPGD 0 P4D 0\\nOops: 0000 [#1] SMP PTI\\nCall Trace:\\n finish_task_switch+0x71/0x230\\n timerqueue_del+0x1d/0x40\\n hrtimer_try_to_cancel+0xb5/0x110\\n xennet_alloc_rx_buffers+0x2a0/0x2a0\\n napi_busy_loop+0xdb/0x270\\n sock_poll+0x87/0x90\\n do_sys_poll+0x26f/0x580\\n tracing_map_insert+0x1d4/0x2f0\\n event_hist_trigger+0x14a/0x260\\n\\n finish_task_switch+0x71/0x230\\n __schedule+0x256/0x890\\n recalc_sigpending+0x1b/0x50\\n xen_sched_clock+0x15/0x20\\n __rb_reserve_next+0x12d/0x140\\n ring_buffer_lock_reserve+0x123/0x3d0\\n event_triggers_call+0x87/0xb0\\n trace_event_buffer_commit+0x1c4/0x210\\n xen_clocksource_get_cycles+0x15/0x20\\n ktime_get_ts64+0x51/0xf0\\n SyS_ppoll+0x160/0x1a0\\n SyS_ppoll+0x160/0x1a0\\n do_syscall_64+0x73/0x130\\n entry_SYSCALL_64_after_hwframe+0x41/0xa6\\n...\\nRIP: xennet_poll+0xae/0xd20 RSP: ffffb4f041933900\\nCR2: 0000000000000008\\n---[ end trace f8601785b354351c ]---\\n\\nxen frontend should remove the NAPIs for the old srings before live\\nmigration as the bond srings are destroyed\\n\\nThere is a tiny window between the srings are set to NULL and\\nthe NAPIs are disabled, It is safe as the NAPI threads are still\\nfrozen at that time\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: xen-netfront: Reparar sring NULL despu\u00e9s de la migraci\u00f3n en vivo Se configura un NAPI para cada sring de red para sondear los datos al kernel El sring con el host de origen se destruye antes de la migraci\u00f3n en vivo y se configura el nuevo sring con el host de destino despu\u00e9s de la migraci\u00f3n en vivo. El NAPI para el sring antiguo no se elimina hasta que se configura el nuevo sring con el host de destino despu\u00e9s de la migraci\u00f3n. Con busy_poll/busy_read habilitado, el NAPI se puede sondear antes de que se elimine cuando se reanuda la VM. ERROR: no se puede manejar la desreferencia del puntero NULL del n\u00facleo en 0000000000000008 IP: xennet_poll+0xae/0xd20 PGD 0 P4D 0 Oops: 0000 [#1] Seguimiento de llamadas PTI de SMP: finish_task_switch+0x71/0x230 timerqueue_del+0x1d/0x40 hrtimer_try_to_cancel+0xb5/0x110 xennet_alloc_rx_buffers+0x2a0/0x2a0 napi_busy_loop+0xdb/0x270 sock_poll+0x87/0x90 do_sys_poll+0x26f/0x580 tracing_map_insert+0x1d4/0x2f0 evento_hist_trigger+0x14a/0x260 finalizar_cambio_tarea+0x71/0x230 __schedule+0x256/0x890 recalc_sigping+0x1b/0x50 xen_sched_clock+0x15/0x20 __rb_reserve_next+0x12d/0x140 reserva_bloqueo_buffer_anillo+0x123/0x3d0 llamada_activadores_evento+0x87/0xb0 confirmaci\u00f3n_buffer_evento_trace+0x1c4/0x210 xen_clocksource_get_cycles+0x15/0x20 ktime_get_ts64+0x51/0xf0 SyS_ppoll+0x160/0x1a0 SyS_ppoll+0x160/0x1a0 do_syscall_64+0x73/0x130 entry_SYSCALL_64_after_hwframe+0x41/0xa6 ... RIP: xennet_poll+0xae/0xd20 RSP: ffffb4f041933900 CR2: 0000000000000008 ---[ fin del seguimiento f8601785b354351c ]--- la interfaz de xen debe eliminar las NAPI de los antiguos srings antes de la migraci\u00f3n en vivo, ya que los srings de enlace se destruyen. Hay una peque\u00f1a ventana entre los srings que se establecen en NULL y los NAPI que se deshabilitan. Es seguro ya que los subprocesos NAPI todav\u00eda est\u00e1n congelados en ese momento.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.24\",\"versionEndExcluding\":\"4.19.269\",\"matchCriteriaId\":\"15C7931B-DA37-4374-B1A0-AE4E0F69FB92\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.227\",\"matchCriteriaId\":\"8C752145-904B-474A-A7F2-E9F29353B0FE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.159\",\"matchCriteriaId\":\"7318B597-DFFD-4BBC-A947-539D6E30D82A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.83\",\"matchCriteriaId\":\"90897BD1-104D-4CFF-94F5-29F9041217FB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.0.13\",\"matchCriteriaId\":\"389392A7-81C4-4C26-884B-8C7CF0F53DA4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"E7E331DA-1FB0-4DEC-91AC-7DA69D461C11\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"17F0B248-42CF-4AE6-A469-BB1BAE7F4705\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"E2422816-0C14-4B5E-A1E6-A9D776E5C49B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"1C6E00FE-5FB9-4D20-A1A1-5A32128F9B76\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"35B26BE4-43A6-4A36-A7F6-5B3F572D9186\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"3FFFB0B3-930D-408A-91E2-BAE0C2715D80\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"8535320E-A0DB-4277-800E-D0CE5BBA59E8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc8:*:*:*:*:*:*\",\"matchCriteriaId\":\"21718AA4-4056-40F2-968E-BDAA465A7872\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/99859947517e446058ad7243ee81d2f9801fa3dd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d50b7914fae04d840ce36491d22133070b18cca9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e6860c889f4ad50b6ab696f5ea154295d72cf27a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e6e897d4fe2f89c0bd94600a40bedf5e6e75e050\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ed773dd798bf720756d20021b8d8a4a3d7184bda\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f2dd60fd3fe98bd36a91b0c6e10bfe9d66258f84\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-48969\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-22T13:19:22.834399Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-22T13:19:25.869Z\"}}], \"cna\": {\"title\": \"xen-netfront: Fix NULL sring after live migration\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4ec2411980d0fd2995e8dea8a06fe57aa47523cb\", \"lessThan\": \"99859947517e446058ad7243ee81d2f9801fa3dd\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4ec2411980d0fd2995e8dea8a06fe57aa47523cb\", \"lessThan\": \"ed773dd798bf720756d20021b8d8a4a3d7184bda\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4ec2411980d0fd2995e8dea8a06fe57aa47523cb\", \"lessThan\": \"e6860c889f4ad50b6ab696f5ea154295d72cf27a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4ec2411980d0fd2995e8dea8a06fe57aa47523cb\", \"lessThan\": \"e6e897d4fe2f89c0bd94600a40bedf5e6e75e050\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4ec2411980d0fd2995e8dea8a06fe57aa47523cb\", \"lessThan\": \"f2dd60fd3fe98bd36a91b0c6e10bfe9d66258f84\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4ec2411980d0fd2995e8dea8a06fe57aa47523cb\", \"lessThan\": \"d50b7914fae04d840ce36491d22133070b18cca9\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/xen-netfront.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.24\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.24\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.269\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.227\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.159\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.83\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.0.13\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.0.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/xen-netfront.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/99859947517e446058ad7243ee81d2f9801fa3dd\"}, {\"url\": \"https://git.kernel.org/stable/c/ed773dd798bf720756d20021b8d8a4a3d7184bda\"}, {\"url\": \"https://git.kernel.org/stable/c/e6860c889f4ad50b6ab696f5ea154295d72cf27a\"}, {\"url\": \"https://git.kernel.org/stable/c/e6e897d4fe2f89c0bd94600a40bedf5e6e75e050\"}, {\"url\": \"https://git.kernel.org/stable/c/f2dd60fd3fe98bd36a91b0c6e10bfe9d66258f84\"}, {\"url\": \"https://git.kernel.org/stable/c/d50b7914fae04d840ce36491d22133070b18cca9\"}], \"x_generator\": {\"engine\": \"bippy-5f407fcff5a0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nxen-netfront: Fix NULL sring after live migration\\n\\nA NAPI is setup for each network sring to poll data to kernel\\nThe sring with source host is destroyed before live migration and\\nnew sring with target host is setup after live migration.\\nThe NAPI for the old sring is not deleted until setup new sring\\nwith target host after migration. With busy_poll/busy_read enabled,\\nthe NAPI can be polled before got deleted when resume VM.\\n\\nBUG: unable to handle kernel NULL pointer dereference at\\n0000000000000008\\nIP: xennet_poll+0xae/0xd20\\nPGD 0 P4D 0\\nOops: 0000 [#1] SMP PTI\\nCall Trace:\\n finish_task_switch+0x71/0x230\\n timerqueue_del+0x1d/0x40\\n hrtimer_try_to_cancel+0xb5/0x110\\n xennet_alloc_rx_buffers+0x2a0/0x2a0\\n napi_busy_loop+0xdb/0x270\\n sock_poll+0x87/0x90\\n do_sys_poll+0x26f/0x580\\n tracing_map_insert+0x1d4/0x2f0\\n event_hist_trigger+0x14a/0x260\\n\\n finish_task_switch+0x71/0x230\\n __schedule+0x256/0x890\\n recalc_sigpending+0x1b/0x50\\n xen_sched_clock+0x15/0x20\\n __rb_reserve_next+0x12d/0x140\\n ring_buffer_lock_reserve+0x123/0x3d0\\n event_triggers_call+0x87/0xb0\\n trace_event_buffer_commit+0x1c4/0x210\\n xen_clocksource_get_cycles+0x15/0x20\\n ktime_get_ts64+0x51/0xf0\\n SyS_ppoll+0x160/0x1a0\\n SyS_ppoll+0x160/0x1a0\\n do_syscall_64+0x73/0x130\\n entry_SYSCALL_64_after_hwframe+0x41/0xa6\\n...\\nRIP: xennet_poll+0xae/0xd20 RSP: ffffb4f041933900\\nCR2: 0000000000000008\\n---[ end trace f8601785b354351c ]---\\n\\nxen frontend should remove the NAPIs for the old srings before live\\nmigration as the bond srings are destroyed\\n\\nThere is a tiny window between the srings are set to NULL and\\nthe NAPIs are disabled, It is safe as the NAPI threads are still\\nfrozen at that time\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-12-19T08:11:35.395Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-48969\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-12-19T08:11:35.395Z\", \"dateReserved\": \"2024-08-22T01:27:53.629Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T20:05:51.051Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.