{
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2022-48633"
      ],
      "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/gma500: Fix WARN_ON(lock-\u003emagic != lock) error\n\npsb_gem_unpin() calls dma_resv_lock() but the underlying ww_mutex\ngets destroyed by drm_gem_object_release() move the\ndrm_gem_object_release() call in psb_gem_free_object() to after\nthe unpin to fix the below warning:\n\n[   79.693962] ------------[ cut here ]------------\n[   79.693992] DEBUG_LOCKS_WARN_ON(lock-\u003emagic != lock)\n[   79.694015] WARNING: CPU: 0 PID: 240 at kernel/locking/mutex.c:582 __ww_mutex_lock.constprop.0+0x569/0xfb0\n[   79.694052] Modules linked in: rfcomm snd_seq_dummy snd_hrtimer qrtr bnep ath9k ath9k_common ath9k_hw snd_hda_codec_realtek snd_hda_codec_generic ledtrig_audio snd_hda_codec_hdmi snd_hda_intel ath3k snd_intel_dspcfg mac80211 snd_intel_sdw_acpi btusb snd_hda_codec btrtl btbcm btintel btmtk bluetooth at24 snd_hda_core snd_hwdep uvcvideo snd_seq libarc4 videobuf2_vmalloc ath videobuf2_memops videobuf2_v4l2 videobuf2_common snd_seq_device videodev acer_wmi intel_powerclamp coretemp mc snd_pcm joydev sparse_keymap ecdh_generic pcspkr wmi_bmof cfg80211 i2c_i801 i2c_smbus snd_timer snd r8169 rfkill lpc_ich soundcore acpi_cpufreq zram rtsx_pci_sdmmc mmc_core serio_raw rtsx_pci gma500_gfx(E) video wmi ip6_tables ip_tables i2c_dev fuse\n[   79.694436] CPU: 0 PID: 240 Comm: plymouthd Tainted: G        W   E      6.0.0-rc3+ #490\n[   79.694457] Hardware name: Packard Bell dot s/SJE01_CT, BIOS V1.10 07/23/2013\n[   79.694469] RIP: 0010:__ww_mutex_lock.constprop.0+0x569/0xfb0\n[   79.694496] Code: ff 85 c0 0f 84 15 fb ff ff 8b 05 ca 3c 11 01 85 c0 0f 85 07 fb ff ff 48 c7 c6 30 cb 84 aa 48 c7 c7 a3 e1 82 aa e8 ac 29 f8 ff \u003c0f\u003e 0b e9 ed fa ff ff e8 5b 83 8a ff 85 c0 74 10 44 8b 0d 98 3c 11\n[   79.694513] RSP: 0018:ffffad1dc048bbe0 EFLAGS: 00010282\n[   79.694623] RAX: 0000000000000028 RBX: 0000000000000000 RCX: 0000000000000000\n[   79.694636] RDX: 0000000000000001 RSI: ffffffffaa8b0ffc RDI: 00000000ffffffff\n[   79.694650] RBP: ffffad1dc048bc80 R08: 0000000000000000 R09: ffffad1dc048ba90\n[   79.694662] R10: 0000000000000003 R11: ffffffffaad62fe8 R12: ffff9ff302103138\n[   79.694675] R13: ffff9ff306ec8000 R14: ffff9ff307779078 R15: ffff9ff3014c0270\n[   79.694690] FS:  00007ff1cccf1740(0000) GS:ffff9ff3bc200000(0000) knlGS:0000000000000000\n[   79.694705] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[   79.694719] CR2: 0000559ecbcb4420 CR3: 0000000013210000 CR4: 00000000000006f0\n[   79.694734] Call Trace:\n[   79.694749]  \u003cTASK\u003e\n[   79.694761]  ? __schedule+0x47f/0x1670\n[   79.694796]  ? psb_gem_unpin+0x27/0x1a0 [gma500_gfx]\n[   79.694830]  ? lock_is_held_type+0xe3/0x140\n[   79.694864]  ? ww_mutex_lock+0x38/0xa0\n[   79.694885]  ? __cond_resched+0x1c/0x30\n[   79.694902]  ww_mutex_lock+0x38/0xa0\n[   79.694925]  psb_gem_unpin+0x27/0x1a0 [gma500_gfx]\n[   79.694964]  psb_gem_unpin+0x199/0x1a0 [gma500_gfx]\n[   79.694996]  drm_gem_object_release_handle+0x50/0x60\n[   79.695020]  ? drm_gem_object_handle_put_unlocked+0xf0/0xf0\n[   79.695042]  idr_for_each+0x4b/0xb0\n[   79.695066]  ? _raw_spin_unlock_irqrestore+0x30/0x60\n[   79.695095]  drm_gem_release+0x1c/0x30\n[   79.695118]  drm_file_free.part.0+0x1ea/0x260\n[   79.695150]  drm_release+0x6a/0x120\n[   79.695175]  __fput+0x9f/0x260\n[   79.695203]  task_work_run+0x59/0xa0\n[   79.695227]  do_exit+0x387/0xbe0\n[   79.695250]  ? seqcount_lockdep_reader_access.constprop.0+0x82/0x90\n[   79.695275]  ? lockdep_hardirqs_on+0x7d/0x100\n[   79.695304]  do_group_exit+0x33/0xb0\n[   79.695331]  __x64_sys_exit_group+0x14/0x20\n[   79.695353]  do_syscall_64+0x58/0x80\n[   79.695376]  ? up_read+0x17/0x20\n[   79.695401]  ? lock_is_held_type+0xe3/0x140\n[   79.695429]  ? asm_exc_page_fault+0x22/0x30\n[   79.695450]  ? lockdep_hardirqs_on+0x7d/0x100\n[   79.695473]  entry_SYSCALL_64_after_hwframe+0x63/0xcd\n[   79.695493] RIP: 0033:0x7ff1ccefe3f1\n[   79.695516] Code: Unable to access opcode bytes at RIP 0x7ff1ccefe3c7.\n[   79.695607] RSP: 002b:00007ffed4413378 EFLAGS: \n---truncated---",
      "id": "GSD-2022-48633",
      "modified": "2024-02-26T06:00:31.515698Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@kernel.org",
        "ID": "CVE-2022-48633",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Linux",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "1da177e4c3f4",
                          "version_value": "55c077d97fa6"
                        },
                        {
                          "version_value": "not down converted",
                          "x_cve_json_5_version_data": {
                            "defaultStatus": "affected",
                            "versions": [
                              {
                                "lessThanOrEqual": "5.19.*",
                                "status": "unaffected",
                                "version": "5.19.12",
                                "versionType": "custom"
                              },
                              {
                                "lessThanOrEqual": "*",
                                "status": "unaffected",
                                "version": "6.0",
                                "versionType": "original_commit_for_fix"
                              }
                            ]
                          }
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Linux"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/gma500: Fix WARN_ON(lock-\u003emagic != lock) error\n\npsb_gem_unpin() calls dma_resv_lock() but the underlying ww_mutex\ngets destroyed by drm_gem_object_release() move the\ndrm_gem_object_release() call in psb_gem_free_object() to after\nthe unpin to fix the below warning:\n\n[   79.693962] ------------[ cut here ]------------\n[   79.693992] DEBUG_LOCKS_WARN_ON(lock-\u003emagic != lock)\n[   79.694015] WARNING: CPU: 0 PID: 240 at kernel/locking/mutex.c:582 __ww_mutex_lock.constprop.0+0x569/0xfb0\n[   79.694052] Modules linked in: rfcomm snd_seq_dummy snd_hrtimer qrtr bnep ath9k ath9k_common ath9k_hw snd_hda_codec_realtek snd_hda_codec_generic ledtrig_audio snd_hda_codec_hdmi snd_hda_intel ath3k snd_intel_dspcfg mac80211 snd_intel_sdw_acpi btusb snd_hda_codec btrtl btbcm btintel btmtk bluetooth at24 snd_hda_core snd_hwdep uvcvideo snd_seq libarc4 videobuf2_vmalloc ath videobuf2_memops videobuf2_v4l2 videobuf2_common snd_seq_device videodev acer_wmi intel_powerclamp coretemp mc snd_pcm joydev sparse_keymap ecdh_generic pcspkr wmi_bmof cfg80211 i2c_i801 i2c_smbus snd_timer snd r8169 rfkill lpc_ich soundcore acpi_cpufreq zram rtsx_pci_sdmmc mmc_core serio_raw rtsx_pci gma500_gfx(E) video wmi ip6_tables ip_tables i2c_dev fuse\n[   79.694436] CPU: 0 PID: 240 Comm: plymouthd Tainted: G        W   E      6.0.0-rc3+ #490\n[   79.694457] Hardware name: Packard Bell dot s/SJE01_CT, BIOS V1.10 07/23/2013\n[   79.694469] RIP: 0010:__ww_mutex_lock.constprop.0+0x569/0xfb0\n[   79.694496] Code: ff 85 c0 0f 84 15 fb ff ff 8b 05 ca 3c 11 01 85 c0 0f 85 07 fb ff ff 48 c7 c6 30 cb 84 aa 48 c7 c7 a3 e1 82 aa e8 ac 29 f8 ff \u003c0f\u003e 0b e9 ed fa ff ff e8 5b 83 8a ff 85 c0 74 10 44 8b 0d 98 3c 11\n[   79.694513] RSP: 0018:ffffad1dc048bbe0 EFLAGS: 00010282\n[   79.694623] RAX: 0000000000000028 RBX: 0000000000000000 RCX: 0000000000000000\n[   79.694636] RDX: 0000000000000001 RSI: ffffffffaa8b0ffc RDI: 00000000ffffffff\n[   79.694650] RBP: ffffad1dc048bc80 R08: 0000000000000000 R09: ffffad1dc048ba90\n[   79.694662] R10: 0000000000000003 R11: ffffffffaad62fe8 R12: ffff9ff302103138\n[   79.694675] R13: ffff9ff306ec8000 R14: ffff9ff307779078 R15: ffff9ff3014c0270\n[   79.694690] FS:  00007ff1cccf1740(0000) GS:ffff9ff3bc200000(0000) knlGS:0000000000000000\n[   79.694705] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[   79.694719] CR2: 0000559ecbcb4420 CR3: 0000000013210000 CR4: 00000000000006f0\n[   79.694734] Call Trace:\n[   79.694749]  \u003cTASK\u003e\n[   79.694761]  ? __schedule+0x47f/0x1670\n[   79.694796]  ? psb_gem_unpin+0x27/0x1a0 [gma500_gfx]\n[   79.694830]  ? lock_is_held_type+0xe3/0x140\n[   79.694864]  ? ww_mutex_lock+0x38/0xa0\n[   79.694885]  ? __cond_resched+0x1c/0x30\n[   79.694902]  ww_mutex_lock+0x38/0xa0\n[   79.694925]  psb_gem_unpin+0x27/0x1a0 [gma500_gfx]\n[   79.694964]  psb_gem_unpin+0x199/0x1a0 [gma500_gfx]\n[   79.694996]  drm_gem_object_release_handle+0x50/0x60\n[   79.695020]  ? drm_gem_object_handle_put_unlocked+0xf0/0xf0\n[   79.695042]  idr_for_each+0x4b/0xb0\n[   79.695066]  ? _raw_spin_unlock_irqrestore+0x30/0x60\n[   79.695095]  drm_gem_release+0x1c/0x30\n[   79.695118]  drm_file_free.part.0+0x1ea/0x260\n[   79.695150]  drm_release+0x6a/0x120\n[   79.695175]  __fput+0x9f/0x260\n[   79.695203]  task_work_run+0x59/0xa0\n[   79.695227]  do_exit+0x387/0xbe0\n[   79.695250]  ? seqcount_lockdep_reader_access.constprop.0+0x82/0x90\n[   79.695275]  ? lockdep_hardirqs_on+0x7d/0x100\n[   79.695304]  do_group_exit+0x33/0xb0\n[   79.695331]  __x64_sys_exit_group+0x14/0x20\n[   79.695353]  do_syscall_64+0x58/0x80\n[   79.695376]  ? up_read+0x17/0x20\n[   79.695401]  ? lock_is_held_type+0xe3/0x140\n[   79.695429]  ? asm_exc_page_fault+0x22/0x30\n[   79.695450]  ? lockdep_hardirqs_on+0x7d/0x100\n[   79.695473]  entry_SYSCALL_64_after_hwframe+0x63/0xcd\n[   79.695493] RIP: 0033:0x7ff1ccefe3f1\n[   79.695516] Code: Unable to access opcode bytes at RIP 0x7ff1ccefe3c7.\n[   79.695607] RSP: 002b:00007ffed4413378 EFLAGS: \n---truncated---"
          }
        ]
      },
      "generator": {
        "engine": "bippy-d175d3acf727"
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://git.kernel.org/stable/c/55c077d97fa67e9f19952bb24122a8316b089474",
            "refsource": "MISC",
            "url": "https://git.kernel.org/stable/c/55c077d97fa67e9f19952bb24122a8316b089474"
          },
          {
            "name": "https://git.kernel.org/stable/c/b6f25c3b94f2aadbf5cbef954db4073614943d74",
            "refsource": "MISC",
            "url": "https://git.kernel.org/stable/c/b6f25c3b94f2aadbf5cbef954db4073614943d74"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/gma500: Fix WARN_ON(lock-\u003emagic != lock) error\n\npsb_gem_unpin() calls dma_resv_lock() but the underlying ww_mutex\ngets destroyed by drm_gem_object_release() move the\ndrm_gem_object_release() call in psb_gem_free_object() to after\nthe unpin to fix the below warning:\n\n[   79.693962] ------------[ cut here ]------------\n[   79.693992] DEBUG_LOCKS_WARN_ON(lock-\u003emagic != lock)\n[   79.694015] WARNING: CPU: 0 PID: 240 at kernel/locking/mutex.c:582 __ww_mutex_lock.constprop.0+0x569/0xfb0\n[   79.694052] Modules linked in: rfcomm snd_seq_dummy snd_hrtimer qrtr bnep ath9k ath9k_common ath9k_hw snd_hda_codec_realtek snd_hda_codec_generic ledtrig_audio snd_hda_codec_hdmi snd_hda_intel ath3k snd_intel_dspcfg mac80211 snd_intel_sdw_acpi btusb snd_hda_codec btrtl btbcm btintel btmtk bluetooth at24 snd_hda_core snd_hwdep uvcvideo snd_seq libarc4 videobuf2_vmalloc ath videobuf2_memops videobuf2_v4l2 videobuf2_common snd_seq_device videodev acer_wmi intel_powerclamp coretemp mc snd_pcm joydev sparse_keymap ecdh_generic pcspkr wmi_bmof cfg80211 i2c_i801 i2c_smbus snd_timer snd r8169 rfkill lpc_ich soundcore acpi_cpufreq zram rtsx_pci_sdmmc mmc_core serio_raw rtsx_pci gma500_gfx(E) video wmi ip6_tables ip_tables i2c_dev fuse\n[   79.694436] CPU: 0 PID: 240 Comm: plymouthd Tainted: G        W   E      6.0.0-rc3+ #490\n[   79.694457] Hardware name: Packard Bell dot s/SJE01_CT, BIOS V1.10 07/23/2013\n[   79.694469] RIP: 0010:__ww_mutex_lock.constprop.0+0x569/0xfb0\n[   79.694496] Code: ff 85 c0 0f 84 15 fb ff ff 8b 05 ca 3c 11 01 85 c0 0f 85 07 fb ff ff 48 c7 c6 30 cb 84 aa 48 c7 c7 a3 e1 82 aa e8 ac 29 f8 ff \u003c0f\u003e 0b e9 ed fa ff ff e8 5b 83 8a ff 85 c0 74 10 44 8b 0d 98 3c 11\n[   79.694513] RSP: 0018:ffffad1dc048bbe0 EFLAGS: 00010282\n[   79.694623] RAX: 0000000000000028 RBX: 0000000000000000 RCX: 0000000000000000\n[   79.694636] RDX: 0000000000000001 RSI: ffffffffaa8b0ffc RDI: 00000000ffffffff\n[   79.694650] RBP: ffffad1dc048bc80 R08: 0000000000000000 R09: ffffad1dc048ba90\n[   79.694662] R10: 0000000000000003 R11: ffffffffaad62fe8 R12: ffff9ff302103138\n[   79.694675] R13: ffff9ff306ec8000 R14: ffff9ff307779078 R15: ffff9ff3014c0270\n[   79.694690] FS:  00007ff1cccf1740(0000) GS:ffff9ff3bc200000(0000) knlGS:0000000000000000\n[   79.694705] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[   79.694719] CR2: 0000559ecbcb4420 CR3: 0000000013210000 CR4: 00000000000006f0\n[   79.694734] Call Trace:\n[   79.694749]  \u003cTASK\u003e\n[   79.694761]  ? __schedule+0x47f/0x1670\n[   79.694796]  ? psb_gem_unpin+0x27/0x1a0 [gma500_gfx]\n[   79.694830]  ? lock_is_held_type+0xe3/0x140\n[   79.694864]  ? ww_mutex_lock+0x38/0xa0\n[   79.694885]  ? __cond_resched+0x1c/0x30\n[   79.694902]  ww_mutex_lock+0x38/0xa0\n[   79.694925]  psb_gem_unpin+0x27/0x1a0 [gma500_gfx]\n[   79.694964]  psb_gem_unpin+0x199/0x1a0 [gma500_gfx]\n[   79.694996]  drm_gem_object_release_handle+0x50/0x60\n[   79.695020]  ? drm_gem_object_handle_put_unlocked+0xf0/0xf0\n[   79.695042]  idr_for_each+0x4b/0xb0\n[   79.695066]  ? _raw_spin_unlock_irqrestore+0x30/0x60\n[   79.695095]  drm_gem_release+0x1c/0x30\n[   79.695118]  drm_file_free.part.0+0x1ea/0x260\n[   79.695150]  drm_release+0x6a/0x120\n[   79.695175]  __fput+0x9f/0x260\n[   79.695203]  task_work_run+0x59/0xa0\n[   79.695227]  do_exit+0x387/0xbe0\n[   79.695250]  ? seqcount_lockdep_reader_access.constprop.0+0x82/0x90\n[   79.695275]  ? lockdep_hardirqs_on+0x7d/0x100\n[   79.695304]  do_group_exit+0x33/0xb0\n[   79.695331]  __x64_sys_exit_group+0x14/0x20\n[   79.695353]  do_syscall_64+0x58/0x80\n[   79.695376]  ? up_read+0x17/0x20\n[   79.695401]  ? lock_is_held_type+0xe3/0x140\n[   79.695429]  ? asm_exc_page_fault+0x22/0x30\n[   79.695450]  ? lockdep_hardirqs_on+0x7d/0x100\n[   79.695473]  entry_SYSCALL_64_after_hwframe+0x63/0xcd\n[   79.695493] RIP: 0033:0x7ff1ccefe3f1\n[   79.695516] Code: Unable to access opcode bytes at RIP 0x7ff1ccefe3c7.\n[   79.695607] RSP: 002b:00007ffed4413378 EFLAGS: \n---truncated---"
          }
        ],
        "id": "CVE-2022-48633",
        "lastModified": "2024-04-28T13:15:06.560",
        "metrics": {},
        "published": "2024-04-28T13:15:06.560",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/55c077d97fa67e9f19952bb24122a8316b089474"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b6f25c3b94f2aadbf5cbef954db4073614943d74"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}