cve-2022-48649
Vulnerability from cvelistv5
Published
2024-04-28 13:00
Modified
2024-09-11 17:33
Severity
Summary
mm/slab_common: fix possible double free of kmem_cache
References
SourceURLTags
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/c673c6ceac53fb2e631c9fbbd79957099a08927f
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d71608a877362becdc94191f190902fac1e64d35
Impacted products
VendorProduct
LinuxLinux
LinuxLinux
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T15:17:55.556Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c673c6ceac53fb2e631c9fbbd79957099a08927f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d71608a877362becdc94191f190902fac1e64d35"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-48649",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:46:11.220120Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:10.427Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/slab_common.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c673c6ceac53",
              "status": "affected",
              "version": "357321557920",
              "versionType": "git"
            },
            {
              "lessThan": "d71608a87736",
              "status": "affected",
              "version": "0495e337b703",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/slab_common.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5.19.12",
              "status": "affected",
              "version": "5.19.8",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/slab_common: fix possible double free of kmem_cache\n\nWhen doing slub_debug test, kfence\u0027s \u0027test_memcache_typesafe_by_rcu\u0027\nkunit test case cause a use-after-free error:\n\n  BUG: KASAN: use-after-free in kobject_del+0x14/0x30\n  Read of size 8 at addr ffff888007679090 by task kunit_try_catch/261\n\n  CPU: 1 PID: 261 Comm: kunit_try_catch Tainted: G    B            N 6.0.0-rc5-next-20220916 #17\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\n  Call Trace:\n   \u003cTASK\u003e\n   dump_stack_lvl+0x34/0x48\n   print_address_description.constprop.0+0x87/0x2a5\n   print_report+0x103/0x1ed\n   kasan_report+0xb7/0x140\n   kobject_del+0x14/0x30\n   kmem_cache_destroy+0x130/0x170\n   test_exit+0x1a/0x30\n   kunit_try_run_case+0xad/0xc0\n   kunit_generic_run_threadfn_adapter+0x26/0x50\n   kthread+0x17b/0x1b0\n   \u003c/TASK\u003e\n\nThe cause is inside kmem_cache_destroy():\n\nkmem_cache_destroy\n    acquire lock/mutex\n    shutdown_cache\n        schedule_work(kmem_cache_release) (if RCU flag set)\n    release lock/mutex\n    kmem_cache_release (if RCU flag not set)\n\nIn some certain timing, the scheduled work could be run before\nthe next RCU flag checking, which can then get a wrong value\nand lead to double kmem_cache_release().\n\nFix it by caching the RCU flag inside protected area, just like \u0027refcnt\u0027"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-29T05:10:51.215Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c673c6ceac53fb2e631c9fbbd79957099a08927f"
        },
        {
          "url": "https://git.kernel.org/stable/c/d71608a877362becdc94191f190902fac1e64d35"
        }
      ],
      "title": "mm/slab_common: fix possible double free of kmem_cache",
      "x_generator": {
        "engine": "bippy-a5840b7849dd"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48649",
    "datePublished": "2024-04-28T13:00:33.390Z",
    "dateReserved": "2024-02-25T13:44:28.316Z",
    "dateUpdated": "2024-09-11T17:33:10.427Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-48649\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-04-28T13:15:07.333\",\"lastModified\":\"2024-04-29T12:42:03.667\",\"vulnStatus\":\"Awaiting Analysis\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm/slab_common: fix possible double free of kmem_cache\\n\\nWhen doing slub_debug test, kfence\u0027s \u0027test_memcache_typesafe_by_rcu\u0027\\nkunit test case cause a use-after-free error:\\n\\n  BUG: KASAN: use-after-free in kobject_del+0x14/0x30\\n  Read of size 8 at addr ffff888007679090 by task kunit_try_catch/261\\n\\n  CPU: 1 PID: 261 Comm: kunit_try_catch Tainted: G    B            N 6.0.0-rc5-next-20220916 #17\\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\\n  Call Trace:\\n   \u003cTASK\u003e\\n   dump_stack_lvl+0x34/0x48\\n   print_address_description.constprop.0+0x87/0x2a5\\n   print_report+0x103/0x1ed\\n   kasan_report+0xb7/0x140\\n   kobject_del+0x14/0x30\\n   kmem_cache_destroy+0x130/0x170\\n   test_exit+0x1a/0x30\\n   kunit_try_run_case+0xad/0xc0\\n   kunit_generic_run_threadfn_adapter+0x26/0x50\\n   kthread+0x17b/0x1b0\\n   \u003c/TASK\u003e\\n\\nThe cause is inside kmem_cache_destroy():\\n\\nkmem_cache_destroy\\n    acquire lock/mutex\\n    shutdown_cache\\n        schedule_work(kmem_cache_release) (if RCU flag set)\\n    release lock/mutex\\n    kmem_cache_release (if RCU flag not set)\\n\\nIn some certain timing, the scheduled work could be run before\\nthe next RCU flag checking, which can then get a wrong value\\nand lead to double kmem_cache_release().\\n\\nFix it by caching the RCU flag inside protected area, just like \u0027refcnt\u0027\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mm/slab_common: correcci\u00f3n posible doble liberaci\u00f3n de kmem_cache Al realizar la prueba slub_debug, el caso de prueba kunit \u0027test_memcache_typesafe_by_rcu\u0027 de kfence causa un error de use-after-free: ERROR: KASAN: uso despu\u00e9s -free en kobject_del+0x14/0x30 Lectura de tama\u00f1o 8 en addr ffff888007679090 por tarea kunit_try_catch/261 CPU: 1 PID: 261 Comm: kunit_try_catch Contaminado: GBN 6.0.0-rc5-next-20220916 #17 Nombre de hardware: PC est\u00e1ndar QEMU ( I440FX+PIIX, 1996), BIOS 1.15.0-1 04/01/2014 TRACE DE LLAMADA:  dump_stack_lvl+0x34/0x48 print_address_description.constprop.0+0x87/0x2a5 print_rePort+0x103/0x1ed kasan_report+0xb7/0x140/0x140/0x140+0xb7/0x140/0x140/0x140/0x14/0x140/0xil 0x14/0x30 kmem_cache_destroy+0x130/0x170 test_exit+0x1a/0x30 kunit_try_run_case+0xad/0xc0 kunit_generic_run_threadfn_adapter+0x26/0x50 kthread+0x17b/0x1b0  La causa est\u00e1 dentro de kmem_cache_destroy (): kmem_cache_destroy adquirir bloqueo/mutex Shutdown_cache Schedule_work(kmem_cache_release) (si el indicador RCU est\u00e1 establecido) liberar bloqueo/mutex kmem_cache_release (si el indicador RCU no est\u00e1 establecido) En un momento determinado, el trabajo programado podr\u00eda ejecutarse antes de la siguiente verificaci\u00f3n del indicador RCU, lo que luego puede obtener un valor incorrecto y provocar un doble kmem_cache_release() . Solucionarlo almacenando en cach\u00e9 la bandera RCU dentro del \u00e1rea protegida, como \u0027refcnt\u0027\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/c673c6ceac53fb2e631c9fbbd79957099a08927f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d71608a877362becdc94191f190902fac1e64d35\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.