GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-48811 (GCVE-0-2022-48811)

Vulnerability from cvelistv5 – Published: 2024-07-16 11:44 – Updated: 2026-05-11 18:47
VLAI
Title
ibmvnic: don't release napi in __ibmvnic_open()
Summary
In the Linux kernel, the following vulnerability has been resolved: ibmvnic: don't release napi in __ibmvnic_open() If __ibmvnic_open() encounters an error such as when setting link state, it calls release_resources() which frees the napi structures needlessly. Instead, have __ibmvnic_open() only clean up the work it did so far (i.e. disable napi and irqs) and leave the rest to the callers. If caller of __ibmvnic_open() is ibmvnic_open(), it should release the resources immediately. If the caller is do_reset() or do_hard_reset(), they will release the resources on the next reset. This fixes following crash that occurred when running the drmgr command several times to add/remove a vnic interface: [102056] ibmvnic 30000003 env3: Disabling rx_scrq[6] irq [102056] ibmvnic 30000003 env3: Disabling rx_scrq[7] irq [102056] ibmvnic 30000003 env3: Replenished 8 pools Kernel attempted to read user page (10) - exploit attempt? (uid: 0) BUG: Kernel NULL pointer dereference on read at 0x00000010 Faulting instruction address: 0xc000000000a3c840 Oops: Kernel access of bad area, sig: 11 [#1] LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries ... CPU: 9 PID: 102056 Comm: kworker/9:2 Kdump: loaded Not tainted 5.16.0-rc5-autotest-g6441998e2e37 #1 Workqueue: events_long __ibmvnic_reset [ibmvnic] NIP: c000000000a3c840 LR: c0080000029b5378 CTR: c000000000a3c820 REGS: c0000000548e37e0 TRAP: 0300 Not tainted (5.16.0-rc5-autotest-g6441998e2e37) MSR: 8000000000009033 <SF,EE,ME,IR,DR,RI,LE> CR: 28248484 XER: 00000004 CFAR: c0080000029bdd24 DAR: 0000000000000010 DSISR: 40000000 IRQMASK: 0 GPR00: c0080000029b55d0 c0000000548e3a80 c0000000028f0200 0000000000000000 ... NIP [c000000000a3c840] napi_enable+0x20/0xc0 LR [c0080000029b5378] __ibmvnic_open+0xf0/0x430 [ibmvnic] Call Trace: [c0000000548e3a80] [0000000000000006] 0x6 (unreliable) [c0000000548e3ab0] [c0080000029b55d0] __ibmvnic_open+0x348/0x430 [ibmvnic] [c0000000548e3b40] [c0080000029bcc28] __ibmvnic_reset+0x500/0xdf0 [ibmvnic] [c0000000548e3c60] [c000000000176228] process_one_work+0x288/0x570 [c0000000548e3d00] [c000000000176588] worker_thread+0x78/0x660 [c0000000548e3da0] [c0000000001822f0] kthread+0x1c0/0x1d0 [c0000000548e3e10] [c00000000000cf64] ret_from_kernel_thread+0x5c/0x64 Instruction dump: 7d2948f8 792307e0 4e800020 60000000 3c4c01eb 384239e0 f821ffd1 39430010 38a0fff6 e92d1100 f9210028 39200000 <e9030010> f9010020 60420000 e9210020 ---[ end trace 5f8033b08fd27706 ]---
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 16:58 UTC
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: ed651a10875f13135a5f59c1bae4d51b377b3925 , < 960dfaf3b578dd23af012590e809ae2d58ba1827 (git)
Affected: ed651a10875f13135a5f59c1bae4d51b377b3925 , < e08cb9056fb2564d1f6bad789bdf79ab09bf2f81 (git)
Affected: ed651a10875f13135a5f59c1bae4d51b377b3925 , < 61772b0908c640d0309c40f7d41d062ca4e979fa (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.12
Unaffected: 0 , < 4.12 (semver)
Unaffected: 5.15.27 , ≤ 5.15.* (semver)
Unaffected: 5.16.10 , ≤ 5.16.* (semver)
Unaffected: 5.17 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T15:25:01.589Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/960dfaf3b578dd23af012590e809ae2d58ba1827"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e08cb9056fb2564d1f6bad789bdf79ab09bf2f81"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/61772b0908c640d0309c40f7d41d062ca4e979fa"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-48811",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:58:31.602565Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:13.187Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/ibm/ibmvnic.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "960dfaf3b578dd23af012590e809ae2d58ba1827",
              "status": "affected",
              "version": "ed651a10875f13135a5f59c1bae4d51b377b3925",
              "versionType": "git"
            },
            {
              "lessThan": "e08cb9056fb2564d1f6bad789bdf79ab09bf2f81",
              "status": "affected",
              "version": "ed651a10875f13135a5f59c1bae4d51b377b3925",
              "versionType": "git"
            },
            {
              "lessThan": "61772b0908c640d0309c40f7d41d062ca4e979fa",
              "status": "affected",
              "version": "ed651a10875f13135a5f59c1bae4d51b377b3925",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/ibm/ibmvnic.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.12"
            },
            {
              "lessThan": "4.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.27",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.27",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16.10",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nibmvnic: don\u0027t release napi in __ibmvnic_open()\n\nIf __ibmvnic_open() encounters an error such as when setting link state,\nit calls release_resources() which frees the napi structures needlessly.\nInstead, have __ibmvnic_open() only clean up the work it did so far (i.e.\ndisable napi and irqs) and leave the rest to the callers.\n\nIf caller of __ibmvnic_open() is ibmvnic_open(), it should release the\nresources immediately. If the caller is do_reset() or do_hard_reset(),\nthey will release the resources on the next reset.\n\nThis fixes following crash that occurred when running the drmgr command\nseveral times to add/remove a vnic interface:\n\n\t[102056] ibmvnic 30000003 env3: Disabling rx_scrq[6] irq\n\t[102056] ibmvnic 30000003 env3: Disabling rx_scrq[7] irq\n\t[102056] ibmvnic 30000003 env3: Replenished 8 pools\n\tKernel attempted to read user page (10) - exploit attempt? (uid: 0)\n\tBUG: Kernel NULL pointer dereference on read at 0x00000010\n\tFaulting instruction address: 0xc000000000a3c840\n\tOops: Kernel access of bad area, sig: 11 [#1]\n\tLE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries\n\t...\n\tCPU: 9 PID: 102056 Comm: kworker/9:2 Kdump: loaded Not tainted 5.16.0-rc5-autotest-g6441998e2e37 #1\n\tWorkqueue: events_long __ibmvnic_reset [ibmvnic]\n\tNIP:  c000000000a3c840 LR: c0080000029b5378 CTR: c000000000a3c820\n\tREGS: c0000000548e37e0 TRAP: 0300   Not tainted  (5.16.0-rc5-autotest-g6441998e2e37)\n\tMSR:  8000000000009033 \u003cSF,EE,ME,IR,DR,RI,LE\u003e  CR: 28248484  XER: 00000004\n\tCFAR: c0080000029bdd24 DAR: 0000000000000010 DSISR: 40000000 IRQMASK: 0\n\tGPR00: c0080000029b55d0 c0000000548e3a80 c0000000028f0200 0000000000000000\n\t...\n\tNIP [c000000000a3c840] napi_enable+0x20/0xc0\n\tLR [c0080000029b5378] __ibmvnic_open+0xf0/0x430 [ibmvnic]\n\tCall Trace:\n\t[c0000000548e3a80] [0000000000000006] 0x6 (unreliable)\n\t[c0000000548e3ab0] [c0080000029b55d0] __ibmvnic_open+0x348/0x430 [ibmvnic]\n\t[c0000000548e3b40] [c0080000029bcc28] __ibmvnic_reset+0x500/0xdf0 [ibmvnic]\n\t[c0000000548e3c60] [c000000000176228] process_one_work+0x288/0x570\n\t[c0000000548e3d00] [c000000000176588] worker_thread+0x78/0x660\n\t[c0000000548e3da0] [c0000000001822f0] kthread+0x1c0/0x1d0\n\t[c0000000548e3e10] [c00000000000cf64] ret_from_kernel_thread+0x5c/0x64\n\tInstruction dump:\n\t7d2948f8 792307e0 4e800020 60000000 3c4c01eb 384239e0 f821ffd1 39430010\n\t38a0fff6 e92d1100 f9210028 39200000 \u003ce9030010\u003e f9010020 60420000 e9210020\n\t---[ end trace 5f8033b08fd27706 ]---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T18:47:35.582Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/960dfaf3b578dd23af012590e809ae2d58ba1827"
        },
        {
          "url": "https://git.kernel.org/stable/c/e08cb9056fb2564d1f6bad789bdf79ab09bf2f81"
        },
        {
          "url": "https://git.kernel.org/stable/c/61772b0908c640d0309c40f7d41d062ca4e979fa"
        }
      ],
      "title": "ibmvnic: don\u0027t release napi in __ibmvnic_open()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48811",
    "datePublished": "2024-07-16T11:44:01.224Z",
    "dateReserved": "2024-07-16T11:38:08.898Z",
    "dateUpdated": "2026-05-11T18:47:35.582Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-48811",
      "date": "2026-09-16",
      "epss": "0.00271",
      "percentile": "0.1937"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nibmvnic: don\u0027t release napi in __ibmvnic_open()\\n\\nIf __ibmvnic_open() encounters an error such as when setting link state,\\nit calls release_resources() which frees the napi structures needlessly.\\nInstead, have __ibmvnic_open() only clean up the work it did so far (i.e.\\ndisable napi and irqs) and leave the rest to the callers.\\n\\nIf caller of __ibmvnic_open() is ibmvnic_open(), it should release the\\nresources immediately. If the caller is do_reset() or do_hard_reset(),\\nthey will release the resources on the next reset.\\n\\nThis fixes following crash that occurred when running the drmgr command\\nseveral times to add/remove a vnic interface:\\n\\n\\t[102056] ibmvnic 30000003 env3: Disabling rx_scrq[6] irq\\n\\t[102056] ibmvnic 30000003 env3: Disabling rx_scrq[7] irq\\n\\t[102056] ibmvnic 30000003 env3: Replenished 8 pools\\n\\tKernel attempted to read user page (10) - exploit attempt? (uid: 0)\\n\\tBUG: Kernel NULL pointer dereference on read at 0x00000010\\n\\tFaulting instruction address: 0xc000000000a3c840\\n\\tOops: Kernel access of bad area, sig: 11 [#1]\\n\\tLE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries\\n\\t...\\n\\tCPU: 9 PID: 102056 Comm: kworker/9:2 Kdump: loaded Not tainted 5.16.0-rc5-autotest-g6441998e2e37 #1\\n\\tWorkqueue: events_long __ibmvnic_reset [ibmvnic]\\n\\tNIP:  c000000000a3c840 LR: c0080000029b5378 CTR: c000000000a3c820\\n\\tREGS: c0000000548e37e0 TRAP: 0300   Not tainted  (5.16.0-rc5-autotest-g6441998e2e37)\\n\\tMSR:  8000000000009033 \u003cSF,EE,ME,IR,DR,RI,LE\u003e  CR: 28248484  XER: 00000004\\n\\tCFAR: c0080000029bdd24 DAR: 0000000000000010 DSISR: 40000000 IRQMASK: 0\\n\\tGPR00: c0080000029b55d0 c0000000548e3a80 c0000000028f0200 0000000000000000\\n\\t...\\n\\tNIP [c000000000a3c840] napi_enable+0x20/0xc0\\n\\tLR [c0080000029b5378] __ibmvnic_open+0xf0/0x430 [ibmvnic]\\n\\tCall Trace:\\n\\t[c0000000548e3a80] [0000000000000006] 0x6 (unreliable)\\n\\t[c0000000548e3ab0] [c0080000029b55d0] __ibmvnic_open+0x348/0x430 [ibmvnic]\\n\\t[c0000000548e3b40] [c0080000029bcc28] __ibmvnic_reset+0x500/0xdf0 [ibmvnic]\\n\\t[c0000000548e3c60] [c000000000176228] process_one_work+0x288/0x570\\n\\t[c0000000548e3d00] [c000000000176588] worker_thread+0x78/0x660\\n\\t[c0000000548e3da0] [c0000000001822f0] kthread+0x1c0/0x1d0\\n\\t[c0000000548e3e10] [c00000000000cf64] ret_from_kernel_thread+0x5c/0x64\\n\\tInstruction dump:\\n\\t7d2948f8 792307e0 4e800020 60000000 3c4c01eb 384239e0 f821ffd1 39430010\\n\\t38a0fff6 e92d1100 f9210028 39200000 \u003ce9030010\u003e f9010020 60420000 e9210020\\n\\t---[ end trace 5f8033b08fd27706 ]---\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ibmvnic: no liberar napi en __ibmvnic_open() Si __ibmvnic_open() encuentra un error como al configurar el estado del enlace, llama a release_resources() que libera las estructuras de napi innecesariamente. En su lugar, haga que __ibmvnic_open() solo limpie el trabajo que hizo hasta ahora (es decir, deshabilite napi e irqs) y deje el resto a las personas que llaman. Si el llamador de __ibmvnic_open() es ibmvnic_open(), deber\\u00eda liberar los recursos inmediatamente. Si la persona que llama es do_reset() o do_hard_reset(), liberar\\u00e1 los recursos en el pr\\u00f3ximo reinicio. Esto corrige el siguiente fallo que se produjo al ejecutar el comando drmgr varias veces para agregar/eliminar una interfaz vnic: [102056] ibmvnic 30000003 env3: deshabilitar rx_scrq[6] irq [102056] ibmvnic 30000003 env3: deshabilitar rx_scrq[7] irq [102056] ibmvnic 30000003 env3: Se reabastecieron 8 grupos. El kernel intent\\u00f3 leer la p\\u00e1gina del usuario (10): \\u00bfintento de explotaci\\u00f3n? (uid: 0) ERROR: Desreferencia del puntero NULL del kernel al leer en 0x00000010 Direcci\\u00f3n de instrucci\\u00f3n err\\u00f3nea: 0xc000000000a3c840 Ups: Acceso al kernel del \\u00e1rea defectuosa, firma: 11 [#1] LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries .. CPU: 9 PID: 102056 Comm: kworker/9:2 Kdump: cargado No contaminado 5.16.0-rc5-autotest-g6441998e2e37 #1 Cola de trabajo: events_long __ibmvnic_reset [ibmvnic] NIP: c000000000a3c840 LR: c0080000029b537. 8 CTR: c000000000a3c820 REGS: c0000000548e37e0 TRAMPA : 0300 No contaminado (5.16.0-rc5-autotest-g6441998e2e37) MSR: 8000000000009033  CR: 28248484 XER: 00000004 CFAR: c0080000029bdd24 DAR: 00000000010 DSISR: 40000000 IRQMASK: 0 GPR00: c0080000029b55d0 c0000000548e3a80 c0000000028f0200 0000000000000000 ... NIP [c000000000a3c840] napi_enable+0x20/0xc0 LR [c0080000029b 5378] __ibmvnic_open+0xf0/0x430 [ibmvnic] Seguimiento de llamadas: [c0000000548e3a80] [0000000000000006] 0x6 (no confiable) [c0000000548e3ab0] [c0080000029b55d0] __ibmvnic_open+0x348/0x430 [ibmvnic] [c0000000548e3b40] [c0080000029bcc28] __ibmvnic_reset+0x500/0xdf0 [ibmvnic] [c0000000548e3c60] [c000000000176228 ] proceso_one_work+0x288/0x570 [c0000000548e3d00] [c000000000176588] hilo_trabajador+0x78/0x660 [c0000000548e3da0] [c0000000001822f0] kthread+0x1c0/0x1d0 [c0000000548e3e10] [c00000000000cf64] ret_from_kernel_thread+0x5c/0x64 Volcado de instrucciones: 7d2948f8 792307e0 4e800020 60000000 3c4c01eb 9e0 f821ffd1 39430010 38a0fff6 e92d1100 f9210028 39200000  f9010020 60420000 e9210020 ---[ final de seguimiento 5f8033b08fd27706 ]---\"}]",
      "id": "CVE-2022-48811",
      "lastModified": "2024-11-21T07:34:08.027",
      "published": "2024-07-16T12:15:05.367",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/61772b0908c640d0309c40f7d41d062ca4e979fa\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/960dfaf3b578dd23af012590e809ae2d58ba1827\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/e08cb9056fb2564d1f6bad789bdf79ab09bf2f81\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/61772b0908c640d0309c40f7d41d062ca4e979fa\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/960dfaf3b578dd23af012590e809ae2d58ba1827\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/e08cb9056fb2564d1f6bad789bdf79ab09bf2f81\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-48811\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-07-16T12:15:05.367\",\"lastModified\":\"2026-06-17T05:16:15.343\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nibmvnic: don\u0027t release napi in __ibmvnic_open()\\n\\nIf __ibmvnic_open() encounters an error such as when setting link state,\\nit calls release_resources() which frees the napi structures needlessly.\\nInstead, have __ibmvnic_open() only clean up the work it did so far (i.e.\\ndisable napi and irqs) and leave the rest to the callers.\\n\\nIf caller of __ibmvnic_open() is ibmvnic_open(), it should release the\\nresources immediately. If the caller is do_reset() or do_hard_reset(),\\nthey will release the resources on the next reset.\\n\\nThis fixes following crash that occurred when running the drmgr command\\nseveral times to add/remove a vnic interface:\\n\\n\\t[102056] ibmvnic 30000003 env3: Disabling rx_scrq[6] irq\\n\\t[102056] ibmvnic 30000003 env3: Disabling rx_scrq[7] irq\\n\\t[102056] ibmvnic 30000003 env3: Replenished 8 pools\\n\\tKernel attempted to read user page (10) - exploit attempt? (uid: 0)\\n\\tBUG: Kernel NULL pointer dereference on read at 0x00000010\\n\\tFaulting instruction address: 0xc000000000a3c840\\n\\tOops: Kernel access of bad area, sig: 11 [#1]\\n\\tLE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries\\n\\t...\\n\\tCPU: 9 PID: 102056 Comm: kworker/9:2 Kdump: loaded Not tainted 5.16.0-rc5-autotest-g6441998e2e37 #1\\n\\tWorkqueue: events_long __ibmvnic_reset [ibmvnic]\\n\\tNIP:  c000000000a3c840 LR: c0080000029b5378 CTR: c000000000a3c820\\n\\tREGS: c0000000548e37e0 TRAP: 0300   Not tainted  (5.16.0-rc5-autotest-g6441998e2e37)\\n\\tMSR:  8000000000009033 \u003cSF,EE,ME,IR,DR,RI,LE\u003e  CR: 28248484  XER: 00000004\\n\\tCFAR: c0080000029bdd24 DAR: 0000000000000010 DSISR: 40000000 IRQMASK: 0\\n\\tGPR00: c0080000029b55d0 c0000000548e3a80 c0000000028f0200 0000000000000000\\n\\t...\\n\\tNIP [c000000000a3c840] napi_enable+0x20/0xc0\\n\\tLR [c0080000029b5378] __ibmvnic_open+0xf0/0x430 [ibmvnic]\\n\\tCall Trace:\\n\\t[c0000000548e3a80] [0000000000000006] 0x6 (unreliable)\\n\\t[c0000000548e3ab0] [c0080000029b55d0] __ibmvnic_open+0x348/0x430 [ibmvnic]\\n\\t[c0000000548e3b40] [c0080000029bcc28] __ibmvnic_reset+0x500/0xdf0 [ibmvnic]\\n\\t[c0000000548e3c60] [c000000000176228] process_one_work+0x288/0x570\\n\\t[c0000000548e3d00] [c000000000176588] worker_thread+0x78/0x660\\n\\t[c0000000548e3da0] [c0000000001822f0] kthread+0x1c0/0x1d0\\n\\t[c0000000548e3e10] [c00000000000cf64] ret_from_kernel_thread+0x5c/0x64\\n\\tInstruction dump:\\n\\t7d2948f8 792307e0 4e800020 60000000 3c4c01eb 384239e0 f821ffd1 39430010\\n\\t38a0fff6 e92d1100 f9210028 39200000 \u003ce9030010\u003e f9010020 60420000 e9210020\\n\\t---[ end trace 5f8033b08fd27706 ]---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ibmvnic: no liberar napi en __ibmvnic_open() Si __ibmvnic_open() encuentra un error como al configurar el estado del enlace, llama a release_resources() que libera las estructuras de napi innecesariamente. En su lugar, haga que __ibmvnic_open() solo limpie el trabajo que hizo hasta ahora (es decir, deshabilite napi e irqs) y deje el resto a las personas que llaman. Si el llamador de __ibmvnic_open() es ibmvnic_open(), deber\u00eda liberar los recursos inmediatamente. Si la persona que llama es do_reset() o do_hard_reset(), liberar\u00e1 los recursos en el pr\u00f3ximo reinicio. Esto corrige el siguiente fallo que se produjo al ejecutar el comando drmgr varias veces para agregar/eliminar una interfaz vnic: [102056] ibmvnic 30000003 env3: deshabilitar rx_scrq[6] irq [102056] ibmvnic 30000003 env3: deshabilitar rx_scrq[7] irq [102056] ibmvnic 30000003 env3: Se reabastecieron 8 grupos. El kernel intent\u00f3 leer la p\u00e1gina del usuario (10): \u00bfintento de explotaci\u00f3n? (uid: 0) ERROR: Desreferencia del puntero NULL del kernel al leer en 0x00000010 Direcci\u00f3n de instrucci\u00f3n err\u00f3nea: 0xc000000000a3c840 Ups: Acceso al kernel del \u00e1rea defectuosa, firma: 11 [#1] LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries .. CPU: 9 PID: 102056 Comm: kworker/9:2 Kdump: cargado No contaminado 5.16.0-rc5-autotest-g6441998e2e37 #1 Cola de trabajo: events_long __ibmvnic_reset [ibmvnic] NIP: c000000000a3c840 LR: c0080000029b537. 8 CTR: c000000000a3c820 REGS: c0000000548e37e0 TRAMPA : 0300 No contaminado (5.16.0-rc5-autotest-g6441998e2e37) MSR: 8000000000009033  CR: 28248484 XER: 00000004 CFAR: c0080000029bdd24 DAR: 00000000010 DSISR: 40000000 IRQMASK: 0 GPR00: c0080000029b55d0 c0000000548e3a80 c0000000028f0200 0000000000000000 ... NIP [c000000000a3c840] napi_enable+0x20/0xc0 LR [c0080000029b 5378] __ibmvnic_open+0xf0/0x430 [ibmvnic] Seguimiento de llamadas: [c0000000548e3a80] [0000000000000006] 0x6 (no confiable) [c0000000548e3ab0] [c0080000029b55d0] __ibmvnic_open+0x348/0x430 [ibmvnic] [c0000000548e3b40] [c0080000029bcc28] __ibmvnic_reset+0x500/0xdf0 [ibmvnic] [c0000000548e3c60] [c000000000176228 ] proceso_one_work+0x288/0x570 [c0000000548e3d00] [c000000000176588] hilo_trabajador+0x78/0x660 [c0000000548e3da0] [c0000000001822f0] kthread+0x1c0/0x1d0 [c0000000548e3e10] [c00000000000cf64] ret_from_kernel_thread+0x5c/0x64 Volcado de instrucciones: 7d2948f8 792307e0 4e800020 60000000 3c4c01eb 9e0 f821ffd1 39430010 38a0fff6 e92d1100 f9210028 39200000  f9010020 60420000 e9210020 ---[ final de seguimiento 5f8033b08fd27706 ]---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/ibm/ibmvnic.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"ed651a10875f13135a5f59c1bae4d51b377b3925\",\"lessThan\":\"960dfaf3b578dd23af012590e809ae2d58ba1827\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ed651a10875f13135a5f59c1bae4d51b377b3925\",\"lessThan\":\"e08cb9056fb2564d1f6bad789bdf79ab09bf2f81\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ed651a10875f13135a5f59c1bae4d51b377b3925\",\"lessThan\":\"61772b0908c640d0309c40f7d41d062ca4e979fa\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/ibm/ibmvnic.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.27\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.16.10\",\"lessThanOrEqual\":\"5.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.17\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T16:58:31.602565Z\",\"id\":\"CVE-2022-48811\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.12\",\"versionEndExcluding\":\"5.15.27\",\"matchCriteriaId\":\"EE357FC9-84EB-4644-8FFE-463B5F2D4983\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.16.10\",\"matchCriteriaId\":\"679523BA-1392-404B-AB85-F5A5408B1ECC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.17:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"7BD5F8D9-54FA-4CB0-B4F0-CB0471FDDB2D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.17:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"E6E34B23-78B4-4516-9BD8-61B33F4AC49A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.17:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"C030FA3D-03F4-4FB9-9DBF-D08E5CAC51AA\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/61772b0908c640d0309c40f7d41d062ca4e979fa\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/960dfaf3b578dd23af012590e809ae2d58ba1827\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e08cb9056fb2564d1f6bad789bdf79ab09bf2f81\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/61772b0908c640d0309c40f7d41d062ca4e979fa\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/960dfaf3b578dd23af012590e809ae2d58ba1827\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e08cb9056fb2564d1f6bad789bdf79ab09bf2f81\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-02-02T10:56:56+00:00",
      "cve": "CVE-2022-48811",
      "id": "CVE-2022-48811",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ibmvnic: don\u0026#39;t release napi in __ibmvnic_open()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-48811.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T16:56:25Z",
      "cve": "CVE-2022-48811",
      "id": "CVE-2022-48811",
      "initial_release_date": "2024-07-17T04:19:02Z",
      "product_status:known_affected": "435",
      "product_status:known_not_affected": "120",
      "product_status:recommended": "581",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-48811",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-48811.json",
      "version": "67"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/960dfaf3b578dd23af012590e809ae2d58ba1827\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/e08cb9056fb2564d1f6bad789bdf79ab09bf2f81\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/61772b0908c640d0309c40f7d41d062ca4e979fa\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T15:25:01.589Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-48811\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:58:31.602565Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:21.428Z\"}}], \"cna\": {\"title\": \"ibmvnic: don\u0027t release napi in __ibmvnic_open()\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"ed651a10875f13135a5f59c1bae4d51b377b3925\", \"lessThan\": \"960dfaf3b578dd23af012590e809ae2d58ba1827\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ed651a10875f13135a5f59c1bae4d51b377b3925\", \"lessThan\": \"e08cb9056fb2564d1f6bad789bdf79ab09bf2f81\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ed651a10875f13135a5f59c1bae4d51b377b3925\", \"lessThan\": \"61772b0908c640d0309c40f7d41d062ca4e979fa\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/ethernet/ibm/ibmvnic.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.12\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.12\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.27\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"5.16.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.16.*\"}, {\"status\": \"unaffected\", \"version\": \"5.17\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/ethernet/ibm/ibmvnic.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/960dfaf3b578dd23af012590e809ae2d58ba1827\"}, {\"url\": \"https://git.kernel.org/stable/c/e08cb9056fb2564d1f6bad789bdf79ab09bf2f81\"}, {\"url\": \"https://git.kernel.org/stable/c/61772b0908c640d0309c40f7d41d062ca4e979fa\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nibmvnic: don\u0027t release napi in __ibmvnic_open()\\n\\nIf __ibmvnic_open() encounters an error such as when setting link state,\\nit calls release_resources() which frees the napi structures needlessly.\\nInstead, have __ibmvnic_open() only clean up the work it did so far (i.e.\\ndisable napi and irqs) and leave the rest to the callers.\\n\\nIf caller of __ibmvnic_open() is ibmvnic_open(), it should release the\\nresources immediately. If the caller is do_reset() or do_hard_reset(),\\nthey will release the resources on the next reset.\\n\\nThis fixes following crash that occurred when running the drmgr command\\nseveral times to add/remove a vnic interface:\\n\\n\\t[102056] ibmvnic 30000003 env3: Disabling rx_scrq[6] irq\\n\\t[102056] ibmvnic 30000003 env3: Disabling rx_scrq[7] irq\\n\\t[102056] ibmvnic 30000003 env3: Replenished 8 pools\\n\\tKernel attempted to read user page (10) - exploit attempt? (uid: 0)\\n\\tBUG: Kernel NULL pointer dereference on read at 0x00000010\\n\\tFaulting instruction address: 0xc000000000a3c840\\n\\tOops: Kernel access of bad area, sig: 11 [#1]\\n\\tLE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries\\n\\t...\\n\\tCPU: 9 PID: 102056 Comm: kworker/9:2 Kdump: loaded Not tainted 5.16.0-rc5-autotest-g6441998e2e37 #1\\n\\tWorkqueue: events_long __ibmvnic_reset [ibmvnic]\\n\\tNIP:  c000000000a3c840 LR: c0080000029b5378 CTR: c000000000a3c820\\n\\tREGS: c0000000548e37e0 TRAP: 0300   Not tainted  (5.16.0-rc5-autotest-g6441998e2e37)\\n\\tMSR:  8000000000009033 \u003cSF,EE,ME,IR,DR,RI,LE\u003e  CR: 28248484  XER: 00000004\\n\\tCFAR: c0080000029bdd24 DAR: 0000000000000010 DSISR: 40000000 IRQMASK: 0\\n\\tGPR00: c0080000029b55d0 c0000000548e3a80 c0000000028f0200 0000000000000000\\n\\t...\\n\\tNIP [c000000000a3c840] napi_enable+0x20/0xc0\\n\\tLR [c0080000029b5378] __ibmvnic_open+0xf0/0x430 [ibmvnic]\\n\\tCall Trace:\\n\\t[c0000000548e3a80] [0000000000000006] 0x6 (unreliable)\\n\\t[c0000000548e3ab0] [c0080000029b55d0] __ibmvnic_open+0x348/0x430 [ibmvnic]\\n\\t[c0000000548e3b40] [c0080000029bcc28] __ibmvnic_reset+0x500/0xdf0 [ibmvnic]\\n\\t[c0000000548e3c60] [c000000000176228] process_one_work+0x288/0x570\\n\\t[c0000000548e3d00] [c000000000176588] worker_thread+0x78/0x660\\n\\t[c0000000548e3da0] [c0000000001822f0] kthread+0x1c0/0x1d0\\n\\t[c0000000548e3e10] [c00000000000cf64] ret_from_kernel_thread+0x5c/0x64\\n\\tInstruction dump:\\n\\t7d2948f8 792307e0 4e800020 60000000 3c4c01eb 384239e0 f821ffd1 39430010\\n\\t38a0fff6 e92d1100 f9210028 39200000 \u003ce9030010\u003e f9010020 60420000 e9210020\\n\\t---[ end trace 5f8033b08fd27706 ]---\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.27\", \"versionStartIncluding\": \"4.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.16.10\", \"versionStartIncluding\": \"4.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.17\", \"versionStartIncluding\": \"4.12\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T18:47:35.582Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-48811\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T18:47:35.582Z\", \"dateReserved\": \"2024-07-16T11:38:08.898Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-07-16T11:44:01.224Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Loading…

Detection rules are retrieved from Rulezet.

Loading…

Loading…

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.


Loading…