cve-2022-48653
Vulnerability from cvelistv5
Published
2024-04-28 13:00
Modified
2024-09-11 17:33
Severity
Summary
ice: Don't double unplug aux on peer initiated reset
References
SourceURLTags
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/149979e87eb7a365d3d0b259bed79d84ff585a93
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/23c619190318376769ad7b61504c2ea0703fb783
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/34447d64b8d28e4d6a73d73f07c879959d68fbfe
Impacted products
VendorProduct
LinuxLinux
LinuxLinux
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T15:17:55.590Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/34447d64b8d28e4d6a73d73f07c879959d68fbfe"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/149979e87eb7a365d3d0b259bed79d84ff585a93"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/23c619190318376769ad7b61504c2ea0703fb783"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-48653",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:46:08.050254Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:09.948Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/ice/ice_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "34447d64b8d2",
              "status": "affected",
              "version": "f9f5301e7e2d",
              "versionType": "git"
            },
            {
              "lessThan": "149979e87eb7",
              "status": "affected",
              "version": "f9f5301e7e2d",
              "versionType": "git"
            },
            {
              "lessThan": "23c619190318",
              "status": "affected",
              "version": "f9f5301e7e2d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/ice/ice_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.71",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "5.19.*",
              "status": "unaffected",
              "version": "5.19.12",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: Don\u0027t double unplug aux on peer initiated reset\n\nIn the IDC callback that is accessed when the aux drivers request a reset,\nthe function to unplug the aux devices is called.  This function is also\ncalled in the ice_prepare_for_reset function. This double call is causing\na \"scheduling while atomic\" BUG.\n\n[  662.676430] ice 0000:4c:00.0 rocep76s0: cqp opcode = 0x1 maj_err_code = 0xffff min_err_code = 0x8003\n\n[  662.676609] ice 0000:4c:00.0 rocep76s0: [Modify QP Cmd Error][op_code=8] status=-29 waiting=1 completion_err=1 maj=0xffff min=0x8003\n\n[  662.815006] ice 0000:4c:00.0 rocep76s0: ICE OICR event notification: oicr = 0x10000003\n\n[  662.815014] ice 0000:4c:00.0 rocep76s0: critical PE Error, GLPE_CRITERR=0x00011424\n\n[  662.815017] ice 0000:4c:00.0 rocep76s0: Requesting a reset\n\n[  662.815475] BUG: scheduling while atomic: swapper/37/0/0x00010002\n\n[  662.815475] BUG: scheduling while atomic: swapper/37/0/0x00010002\n[  662.815477] Modules linked in: rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs rfkill 8021q garp mrp stp llc vfat fat rpcrdma intel_rapl_msr intel_rapl_common sunrpc i10nm_edac rdma_ucm nfit ib_srpt libnvdimm ib_isert iscsi_target_mod x86_pkg_temp_thermal intel_powerclamp coretemp target_core_mod snd_hda_intel ib_iser snd_intel_dspcfg libiscsi snd_intel_sdw_acpi scsi_transport_iscsi kvm_intel iTCO_wdt rdma_cm snd_hda_codec kvm iw_cm ipmi_ssif iTCO_vendor_support snd_hda_core irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel snd_hwdep snd_seq snd_seq_device rapl snd_pcm snd_timer isst_if_mbox_pci pcspkr isst_if_mmio irdma intel_uncore idxd acpi_ipmi joydev isst_if_common snd mei_me idxd_bus ipmi_si soundcore i2c_i801 mei ipmi_devintf i2c_smbus i2c_ismt ipmi_msghandler acpi_power_meter acpi_pad rv(OE) ib_uverbs ib_cm ib_core xfs libcrc32c ast i2c_algo_bit drm_vram_helper drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm_ttm_helpe\n r ttm\n[  662.815546]  nvme nvme_core ice drm crc32c_intel i40e t10_pi wmi pinctrl_emmitsburg dm_mirror dm_region_hash dm_log dm_mod fuse\n[  662.815557] Preemption disabled at:\n[  662.815558] [\u003c0000000000000000\u003e] 0x0\n[  662.815563] CPU: 37 PID: 0 Comm: swapper/37 Kdump: loaded Tainted: G S         OE     5.17.1 #2\n[  662.815566] Hardware name: Intel Corporation D50DNP/D50DNP, BIOS SE5C6301.86B.6624.D18.2111021741 11/02/2021\n[  662.815568] Call Trace:\n[  662.815572]  \u003cIRQ\u003e\n[  662.815574]  dump_stack_lvl+0x33/0x42\n[  662.815581]  __schedule_bug.cold.147+0x7d/0x8a\n[  662.815588]  __schedule+0x798/0x990\n[  662.815595]  schedule+0x44/0xc0\n[  662.815597]  schedule_preempt_disabled+0x14/0x20\n[  662.815600]  __mutex_lock.isra.11+0x46c/0x490\n[  662.815603]  ? __ibdev_printk+0x76/0xc0 [ib_core]\n[  662.815633]  device_del+0x37/0x3d0\n[  662.815639]  ice_unplug_aux_dev+0x1a/0x40 [ice]\n[  662.815674]  ice_schedule_reset+0x3c/0xd0 [ice]\n[  662.815693]  irdma_iidc_event_handler.cold.7+0xb6/0xd3 [irdma]\n[  662.815712]  ? bitmap_find_next_zero_area_off+0x45/0xa0\n[  662.815719]  ice_send_event_to_aux+0x54/0x70 [ice]\n[  662.815741]  ice_misc_intr+0x21d/0x2d0 [ice]\n[  662.815756]  __handle_irq_event_percpu+0x4c/0x180\n[  662.815762]  handle_irq_event_percpu+0xf/0x40\n[  662.815764]  handle_irq_event+0x34/0x60\n[  662.815766]  handle_edge_irq+0x9a/0x1c0\n[  662.815770]  __common_interrupt+0x62/0x100\n[  662.815774]  common_interrupt+0xb4/0xd0\n[  662.815779]  \u003c/IRQ\u003e\n[  662.815780]  \u003cTASK\u003e\n[  662.815780]  asm_common_interrupt+0x1e/0x40\n[  662.815785] RIP: 0010:cpuidle_enter_state+0xd6/0x380\n[  662.815789] Code: 49 89 c4 0f 1f 44 00 00 31 ff e8 65 d7 95 ff 45 84 ff 74 12 9c 58 f6 c4 02 0f 85 64 02 00 00 31 ff e8 ae c5 9c ff fb 45 85 f6 \u003c0f\u003e 88 12 01 00 00 49 63 d6 4c 2b 24 24 48 8d 04 52 48 8d 04 82 49\n[  662.815791] RSP: 0018:ff2c2c4f18edbe80 EFLAGS: 00000202\n[  662.815793] RAX: ff280805df140000 RBX: 0000000000000002 RCX: 000000000000001f\n[  662.815795] RDX: 0000009a52da2d08 R\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-29T05:10:55.541Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/34447d64b8d28e4d6a73d73f07c879959d68fbfe"
        },
        {
          "url": "https://git.kernel.org/stable/c/149979e87eb7a365d3d0b259bed79d84ff585a93"
        },
        {
          "url": "https://git.kernel.org/stable/c/23c619190318376769ad7b61504c2ea0703fb783"
        }
      ],
      "title": "ice: Don\u0027t double unplug aux on peer initiated reset",
      "x_generator": {
        "engine": "bippy-a5840b7849dd"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48653",
    "datePublished": "2024-04-28T13:00:52.055Z",
    "dateReserved": "2024-02-25T13:44:28.317Z",
    "dateUpdated": "2024-09-11T17:33:09.948Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-48653\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-04-28T13:15:07.530\",\"lastModified\":\"2024-04-29T12:42:03.667\",\"vulnStatus\":\"Awaiting Analysis\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nice: Don\u0027t double unplug aux on peer initiated reset\\n\\nIn the IDC callback that is accessed when the aux drivers request a reset,\\nthe function to unplug the aux devices is called.  This function is also\\ncalled in the ice_prepare_for_reset function. This double call is causing\\na \\\"scheduling while atomic\\\" BUG.\\n\\n[  662.676430] ice 0000:4c:00.0 rocep76s0: cqp opcode = 0x1 maj_err_code = 0xffff min_err_code = 0x8003\\n\\n[  662.676609] ice 0000:4c:00.0 rocep76s0: [Modify QP Cmd Error][op_code=8] status=-29 waiting=1 completion_err=1 maj=0xffff min=0x8003\\n\\n[  662.815006] ice 0000:4c:00.0 rocep76s0: ICE OICR event notification: oicr = 0x10000003\\n\\n[  662.815014] ice 0000:4c:00.0 rocep76s0: critical PE Error, GLPE_CRITERR=0x00011424\\n\\n[  662.815017] ice 0000:4c:00.0 rocep76s0: Requesting a reset\\n\\n[  662.815475] BUG: scheduling while atomic: swapper/37/0/0x00010002\\n\\n[  662.815475] BUG: scheduling while atomic: swapper/37/0/0x00010002\\n[  662.815477] Modules linked in: rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs rfkill 8021q garp mrp stp llc vfat fat rpcrdma intel_rapl_msr intel_rapl_common sunrpc i10nm_edac rdma_ucm nfit ib_srpt libnvdimm ib_isert iscsi_target_mod x86_pkg_temp_thermal intel_powerclamp coretemp target_core_mod snd_hda_intel ib_iser snd_intel_dspcfg libiscsi snd_intel_sdw_acpi scsi_transport_iscsi kvm_intel iTCO_wdt rdma_cm snd_hda_codec kvm iw_cm ipmi_ssif iTCO_vendor_support snd_hda_core irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel snd_hwdep snd_seq snd_seq_device rapl snd_pcm snd_timer isst_if_mbox_pci pcspkr isst_if_mmio irdma intel_uncore idxd acpi_ipmi joydev isst_if_common snd mei_me idxd_bus ipmi_si soundcore i2c_i801 mei ipmi_devintf i2c_smbus i2c_ismt ipmi_msghandler acpi_power_meter acpi_pad rv(OE) ib_uverbs ib_cm ib_core xfs libcrc32c ast i2c_algo_bit drm_vram_helper drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm_ttm_helpe\\n r ttm\\n[  662.815546]  nvme nvme_core ice drm crc32c_intel i40e t10_pi wmi pinctrl_emmitsburg dm_mirror dm_region_hash dm_log dm_mod fuse\\n[  662.815557] Preemption disabled at:\\n[  662.815558] [\u003c0000000000000000\u003e] 0x0\\n[  662.815563] CPU: 37 PID: 0 Comm: swapper/37 Kdump: loaded Tainted: G S         OE     5.17.1 #2\\n[  662.815566] Hardware name: Intel Corporation D50DNP/D50DNP, BIOS SE5C6301.86B.6624.D18.2111021741 11/02/2021\\n[  662.815568] Call Trace:\\n[  662.815572]  \u003cIRQ\u003e\\n[  662.815574]  dump_stack_lvl+0x33/0x42\\n[  662.815581]  __schedule_bug.cold.147+0x7d/0x8a\\n[  662.815588]  __schedule+0x798/0x990\\n[  662.815595]  schedule+0x44/0xc0\\n[  662.815597]  schedule_preempt_disabled+0x14/0x20\\n[  662.815600]  __mutex_lock.isra.11+0x46c/0x490\\n[  662.815603]  ? __ibdev_printk+0x76/0xc0 [ib_core]\\n[  662.815633]  device_del+0x37/0x3d0\\n[  662.815639]  ice_unplug_aux_dev+0x1a/0x40 [ice]\\n[  662.815674]  ice_schedule_reset+0x3c/0xd0 [ice]\\n[  662.815693]  irdma_iidc_event_handler.cold.7+0xb6/0xd3 [irdma]\\n[  662.815712]  ? bitmap_find_next_zero_area_off+0x45/0xa0\\n[  662.815719]  ice_send_event_to_aux+0x54/0x70 [ice]\\n[  662.815741]  ice_misc_intr+0x21d/0x2d0 [ice]\\n[  662.815756]  __handle_irq_event_percpu+0x4c/0x180\\n[  662.815762]  handle_irq_event_percpu+0xf/0x40\\n[  662.815764]  handle_irq_event+0x34/0x60\\n[  662.815766]  handle_edge_irq+0x9a/0x1c0\\n[  662.815770]  __common_interrupt+0x62/0x100\\n[  662.815774]  common_interrupt+0xb4/0xd0\\n[  662.815779]  \u003c/IRQ\u003e\\n[  662.815780]  \u003cTASK\u003e\\n[  662.815780]  asm_common_interrupt+0x1e/0x40\\n[  662.815785] RIP: 0010:cpuidle_enter_state+0xd6/0x380\\n[  662.815789] Code: 49 89 c4 0f 1f 44 00 00 31 ff e8 65 d7 95 ff 45 84 ff 74 12 9c 58 f6 c4 02 0f 85 64 02 00 00 31 ff e8 ae c5 9c ff fb 45 85 f6 \u003c0f\u003e 88 12 01 00 00 49 63 d6 4c 2b 24 24 48 8d 04 52 48 8d 04 82 49\\n[  662.815791] RSP: 0018:ff2c2c4f18edbe80 EFLAGS: 00000202\\n[  662.815793] RAX: ff280805df140000 RBX: 0000000000000002 RCX: 000000000000001f\\n[  662.815795] RDX: 0000009a52da2d08 R\\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: ice: no desconectar dos veces el auxiliar en el reinicio iniciado por el par. En la devoluci\u00f3n de llamada de IDC a la que se accede cuando los controladores auxiliares solicitan un reinicio, se llama a la funci\u00f3n para desconectar los dispositivos auxiliares. Esta funci\u00f3n tambi\u00e9n se llama en la funci\u00f3n ice_prepare_for_reset. Esta doble llamada est\u00e1 provocando un ERROR de \\\"programaci\u00f3n at\u00f3mica\\\". [662.676430] ice 0000:4c:00.0 rocep76s0: cqp opcode = 0x1 maj_err_code = 0xffff min_err_code = 0x8003 [662.676609] ice 0000:4c:00.0 rocep76s0: [Modificar error de comando QP][op_code=8] =-29 esperando=1 complete_err=1 maj=0xffff min=0x8003 [662.815006] ice 0000:4c:00.0 rocep76s0: Notificaci\u00f3n de evento ICE OICR: oicr = 0x10000003 [662.815014] ice 0000:4c:00.0 rocep76s0: Error PE cr\u00edtico, GLPE_CRITERR= 0x00011424 [662.815017] hielo 0000:4c:00.0 rocep76s0: Solicitando un reinicio [662.815475] ERROR: programaci\u00f3n mientras at\u00f3mico: swapper/37/0/0x00010002 [662.815475] ERROR: programaci\u00f3n mientras at\u00f3mico: swapper/37/0/0x00010002 [ 662.815477] M\u00f3dulos vinculados en: rpcsec_gss_krb5 aut\u00e9ntico x86_pkg_temp_thermal intel_powerclamp coretemp target_core_mod snd_hda_intel ib_iser snd_intel_dspcfg libiscsi snd_intel_sdw_acpi scsi_transport_iscsi kvm_intel iTCO_wdt rdma_cm snd_hda_codec kvm iw_cm ipmi_ssif iTCO_vendor_support s nd_hda_core irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel snd_hwdep snd_seq snd_seq_device rapl snd_pcm snd_timer isst_if_mbox_pci pcspkr isst_if_mmio irdma intel_uncore idxd acpi_ipmi joydev isst_if_common snd mei_me idxd_bus ipmi_si soundcore i2c_i801 mei i2c_smbus i2c_ismt ipmi_msghandler acpi_power_meter acpi_pad rv(OE) ib_uverbs ib_cm ib_core xfs libcrc32c ast i2c_algo_bit drm_vram_helper drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm_ttm_helpe r ttm [ 662.815546 ] nvme nvme_core ice drm crc32c_intel i40e t10_pi wmi pinctrl_emmitsburg dm_mirror dm_region_hash dm_log dm_mod fuse [ 662.815557] Preferencia deshabilitada en: [ 662.815558] [\u0026lt;0000000000000000\u0026gt;] 0x0 [ 6 62.815563] CPU: 37 PID: 0 Comunicaciones: intercambiador/37 Kdump: cargado Contaminado: GS OE 5.17.1 #2 [ 662.815566] Nombre del hardware: Intel Corporation D50DNP/D50DNP, BIOS SE5C6301.86B.6624.D18.2111021741 02/11/2021 [ 662.815568] Seguimiento de llamadas: [ 662.815572]  [ 662 .815574] dump_stack_lvl +0x33/0x42 [ 662.815581] __schedule_bug.cold.147+0x7d/0x8a [ 662.815588] __schedule+0x798/0x990 [ 662.815595] horario+0x44/0xc0 [ 662.815597] +0x14/0x20 [ 662.815600] __mutex_lock.isra.11+0x46c /0x490 [662.815603] ? __ibdev_printk+0x76/0xc0 [ib_core] [ 662.815633] dispositivo_del+0x37/0x3d0 [ 662.815639] ice_unplug_aux_dev+0x1a/0x40 [ice] [ 662.815674] ice_schedule_reset+0x3c/0xd0 [ice] [ 2.815693] irdma_iidc_event_handler.cold.7+0xb6/0xd3 [irdma] [662.815712] ? bitmap_find_next_zero_area_off+0x45/0xa0 [ 662.815719] ice_send_event_to_aux+0x54/0x70 [ice] [ 662.815741] ice_misc_intr+0x21d/0x2d0 [ice] [ 662.815756] pu+0x4c/0x180 [ 662.815762] handle_irq_event_percpu+0xf/0x40 [ 662.815764] handle_irq_event+0x34/ 0x60 [ 662.815766] handle_edge_irq+0x9a/0x1c0 [ 662.815770] __common_interrupt+0x62/0x100 [ 662.815774] common_interrupt+0xb4/0xd0 [ 662.815779]  [ 662.81578 0]  [ 662.815780] asm_common_interrupt+0x1e/0x40 [ 662.815785] RIP : 0010:cpuidle_enter_state+0xd6/0x380 [ 662.815789] C\u00f3digo: 49 89 c4 0f 1f 44 00 00 31 ff e8 65 d7 95 ff 45 84 ff 74 12 9c 58 f6 c4 02 0f 85 64 02 00 31 ff e8 ae c5 9c ff fb 45 85 f6 \u0026lt;0f\u0026gt; 88 12 01 00 00 49 63 d6 4c 2b 24 24 48 8d 04 52 48 8d 04 82 49 [ 662.815791] RSP: 0018:ff2c2c4f18edbe80 EFLAGS: 0202 [662.815793] RAX: ff280805df140000 RBX: 0000000000000002 RCX : 000000000000001f [ 662.815795] RDX: 0000009a52da2d08 R ---truncado---\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/149979e87eb7a365d3d0b259bed79d84ff585a93\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/23c619190318376769ad7b61504c2ea0703fb783\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/34447d64b8d28e4d6a73d73f07c879959d68fbfe\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.