CVE-2022-3169: Input Validation
A flaw was found in the Linux kernel. A denial of service flaw may occur if there is a consecutive request of the NVMEIOCTLRESET and the NVMEIOCTLSUBSYSRESET through the device file of the driver, resulting in a PCIe link disconnect.
Other sources
Vulnerability Description: -------------------------- The latest version of linux nvme driver will cause system crash when processing NVMEIOCTLRESET and NVMEIOCTLSUBSYSRESET of user mode ioctl.
Attack Process Description:
Quickly send NVMEIOCTLSUBSYSRESET through the device file of the driver,this operation will cause the PCIe link to be disconnected. The driver does not check the validity of the register before accessing the register.
As a result, kernel unable to handle kernel paging request at virtual address ffff000081c42020. It is important to note that this operation does not require validation of the capsysadmin permission.
Trace: [361245.754472] nvme nvme2: resetting controller [361245.754500] nvme nvme2: resetting controller [361245.761914] nvme nvme2: resetting controller [361245.762081] nvme nvme2: resetting controller [361245.762136] nvme nvme2: resetting controller [361245.762246] Unable to handle kernel paging request at virtual address ffff000081c42020 [361245.762247] Mem abort info: [361245.762248] ESR = 0x96000047 [361245.762250] Exception class = DABT (current EL), IL = 32 bits [361245.762251] SET = 0, FnV = 0 [361245.762251] EA = 0, S1PTW = 0 [361245.762252] Data abort info: [361245.762253] ISV = 0, ISS = 0x00000047 [361245.762254] CM = 0, WnR = 1 [361245.762256] swapper pgtable: 4k pages, 48-bit VAs, pgdp = 00000000c96d3c05 [361245.762258] [ffff000081c42020] pgd=00002027ffffe003, pud=00002027ffffd003, pmd=00000027df6be003, pte=0000000000000000 [361245.762263] Internal error: Oops: 96000047 [#1] SMP [361245.767407] Process trinity-c383 (pid: 2157089, stack limit = 0xffff000099ea8000) [361245.775244] CPU: 95 PID: 2157089 Comm: trinity-c383 Kdump: loaded Tainted: G OE 4.19.90-vhulk2011.1.0.h352.eulerosv2r9.aarch64 #1 [361245.788669] Hardware name: Huawei TaiShan 2280 V2/BC82AMDDA, BIOS 1.08 09/15/2019 [361245.796505] pstate: 60400009 (nZCv daif +PAN -UAO) [361245.801548] pc : nvmepciregwrite32+0x30/0x48 [nvme] [361245.806954] lr : nvmedevioctl+0x74/0x1f0 [nvmecore] [361245.812353] sp : ffff000099eabd00 [361245.815856] x29: ffff000099eabd00 x28: ffff80277c503e00 [361245.821434] x27: 0000000000000000 x26: 0000000000000000 [361245.827009] x25: 0000000056000000 x24: ffff8027811fdd68 [361245.832587] x23: ffff8027d26e2700 x22: 0000000000000185 [361245.838164] x21: ffffa0277d04e238 x20: 000000004e564d65 [361245.843740] x19: ffff000081c42020 x18: 0000000000000000 [361245.849315] x17: 0000000000000000 x16: 0000000000000000 [361245.854891] x15: 0000000000000000 x14: 0000000000000000 [361245.860467] x13: 0000000000000000 x12: 0000000000000000 [361245.866043] x11: 0000000000000000 x10: 0000000000000000 [361245.871620] x9 : 0000000000000000 x8 : 0000000000000000 [361245.877197] x7 : ffff000099eabda8 x6 : 0000000000000000 [361245.882774] x5 : 0000000000000000 x4 : 0000000000000000 [361245.888350] x3 : ffff000000b180d0 x2 : 000000004e564d65 [361245.893929] x1 : ffff000081c42000 x0 : ffff000000aaedcc [361245.899508] Call trace: [361245.906638] nvmepciregwrite32+0x30/0x48 [nvme] [361245.916366] nvmedevioctl+0x74/0x1f0 [nvmecore] [361245.925984] dovfsioctl+0xc4/0x8c0 [361245.934237] ksysioctl+0x8c/0xa0 [361245.942028] arm64sysioctl+0x28/0x98 [361245.950291] el0svccommon+0x80/0x1b8 [361245.958202] el0svchandler+0x78/0xe0 [361245.965904] el0svc+0x10/0x260 [361245.972778] Code: d503201f d5033e9f f85682a1 8b334033 (b9000274) [361245.982651] kernel fault(0x1) notification starting on CPU 95 [361245.992186] kernel fault(0x1) notification finished on CPU 95 [361246.001591] [kbox] catch die event on cpu 95. [361246.009623] [kbox] catch die event, start logging. [361246.018015] [kbox] die info:Oops:0047. [361246.025366] [kbox] start to collect. [361246.033241] [kbox] collectedlen = 176005, glogbuflenlocal = 1048576 [361246.043774] [kbox] save kbox pre log success. [361246.052027] [kbox] stack: [361246.058383] [kbox] stack grow form: 0xffff000099eabd00 to 0xffff000099eac000. [361246.073378] [kbox] bd00: ffff000099eabd30 ffff000000aaedcc 0000000000004e45 ffffa0277d04e238 [361246.090743] [kbox] bd20: 0000000000000074 0000000000004e45 ffff000099eabd70 ffff00008038ec2c [361246.109144] [kbox] bd40: ffff00008128a000 0000000000004e45 0000000000000074 ffff00008045ee8c [361246.128431] [kbox] bd60: ffff000081316880 0000000000000074 ffff000099eabe00 ffff00008038f4b4 [361246.148516] [kbox] bd80: ffff8027d26e2700 0000000000000000 ffff8027d26e2700 0000000000000185 [361246.169300] [kbox] bda0: 0000000000004e45 0000000000000074 ffff000099eabd90 ffff0000801f5bc0 [361246.190529] [kbox] bdc0: ffff000099eabde0 2004bb3357eeb400 ffff000099eabe00 ffff00008038f474 [361246.212439] [kbox] bde0: ffff8027d26e2700 ffff000099eabec0 ffff8027d26e2700 2004bb3357eeb400 [361246.235176] [kbox] be00: ffff000099eabe40 ffff00008038f4f0 ffff000099eabec0 ffff000099eabec0 [361246.258513] [kbox] be20: ffffffffffffffff 0000000000000200 ffff000080aa1698 0000000000000015 [361246.282326] [kbox] be40: ffff000099eabe60 ffff000080099e98 000000000000001d ffff000080099e98 [361246.306913] [kbox] be60: ffff000099eabea0 ffff00008009a048 ffff000099eabec0 0000a0275e7d3000 [361246.332091] [kbox] be80: 00000000ffffffff 0000ffff97339614 0000000040000000 ffff000080083c0c [361246.357695] [kbox] bea0: ffff000099eabff0 ffff000080084250 0000000000000200 ffff000080084148 ..
Vulnerable code /drivers/nvme/host/pci.c static int nvmepciregread32(struct nvmectrl ctrl, u32 off, u32 val) { val = readl(tonvmedev(ctrl)->bar + off); return 0; }
static int nvmepciregwrite32(struct nvmectrl ctrl, u32 off, u32 val) { writel(val, tonvmedev(ctrl)->bar + off); return 0; }
static int nvmepciregread64(struct nvmectrl ctrl, u32 off, u64 val) { val = lohireadq(tonvmedev(ctrl)->bar + off); return 0; }
It's worth mentioning that I submitted this issue to Bugzilla in October last year, but I found that the issue remains unresolved to this day. https://bugzilla.kernel.org/showbug.cgi?id=214771
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.0.10-1 - Upgrade
Upgrade
ubuntu/linux-aws-5.4to a version that resolves this vulnerability.Fixed in 5.4.0-1097.105~18.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-5.4to a version that resolves this vulnerability.Fixed in 5.4.0-1104.110~18.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-5.4to a version that resolves this vulnerability.Fixed in 5.4.0-1101.110~18.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-5.4to a version that resolves this vulnerability.Fixed in 5.4.0-144.161~18.04.1 - Upgrade
Upgrade
ubuntu/linux-ibm-5.4to a version that resolves this vulnerability.Fixed in 5.4.0-1045.50~18.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-5.4to a version that resolves this vulnerability.Fixed in 5.4.0-1094.103~18.04.1 - Upgrade
Upgrade
ubuntu/linux-raspi-5.4to a version that resolves this vulnerability.Fixed in 5.4.0-1081.92~18.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 5.4.0-144.161 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 5.4.0-1097.105 - Upgrade
Upgrade
ubuntu/linux-aws-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1031.35~20.04.1 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 5.4.0-1104.110 - Upgrade
Upgrade
ubuntu/linux-azure-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1034.41~20.04.1 - Upgrade
Upgrade
ubuntu/linux-bluefieldto a version that resolves this vulnerability.Fixed in 5.4.0-1059.65 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 5.4.0-1101.110 - Upgrade
Upgrade
ubuntu/linux-gcp-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1030.37~20.04.1 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 5.4.0-1095.102 - Upgrade
Upgrade
ubuntu/linux-gke-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1028.33~20.04.1 - Upgrade
Upgrade
ubuntu/linux-gkeopto a version that resolves this vulnerability.Fixed in 5.4.0-1065.69 - Upgrade
Upgrade
ubuntu/linux-gkeop-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1016.21~20.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-67.74~20.04.1 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 5.4.0-1045.50 - Upgrade
Upgrade
ubuntu/linux-intel-iotg-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1026.31~20.04.1 - Upgrade
Upgrade
ubuntu/linux-iotto a version that resolves this vulnerability.Fixed in 5.4.0-1013.15 - Upgrade
Upgrade
ubuntu/linux-kvmto a version that resolves this vulnerability.Fixed in 5.4.0-1087.93 - Upgrade
Upgrade
ubuntu/linux-lowlatency-hwe-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-67.74~20.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegra-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1014.14~20.04.1 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 5.4.0-1094.103 - Upgrade
Upgrade
ubuntu/linux-oracle-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1030.36~20.04.1 - Upgrade
Upgrade
ubuntu/linux-raspito a version that resolves this vulnerability.Fixed in 5.4.0-1081.92 - Upgrade
Upgrade
ubuntu/linux-riscv-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1030.34~20.04.1 - Upgrade
Upgrade
ubuntu/linux-xilinx-zynqmpto a version that resolves this vulnerability.Fixed in 5.4.0-1022.26 - Upgrade
Upgrade
ubuntu/linux-aws-fipsto a version that resolves this vulnerability.Fixed in 5.4.0-1099.107+fips1 - Upgrade
Upgrade
ubuntu/linux-azure-fipsto a version that resolves this vulnerability.Fixed in 5.4.0-1104.110+fips1 - Upgrade
Upgrade
ubuntu/linux-fipsto a version that resolves this vulnerability.Fixed in 5.4.0-1073.82 - Upgrade
Upgrade
ubuntu/linux-gcp-fipsto a version that resolves this vulnerability.Fixed in 5.4.0-1101.110+fips1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 5.15.0-67.74 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 5.15.0-1031.35 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 5.15.0-1034.41 - Upgrade
Upgrade
ubuntu/linux-azure-5.19to a version that resolves this vulnerability.Fixed in 5.19.0-1021.22~22.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 5.15.0-1034.41.1 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 5.15.0-1030.37 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 5.15.0-1028.33 - Upgrade
Upgrade
ubuntu/linux-gkeopto a version that resolves this vulnerability.Fixed in 5.15.0-1016.21 - Upgrade
Upgrade
ubuntu/linux-hwe-5.19to a version that resolves this vulnerability.Fixed in 5.19.0-35.36~22.04.1 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 5.15.0-1026.29 - Upgrade
Upgrade
ubuntu/linux-intel-iotgto a version that resolves this vulnerability.Fixed in 5.15.0-1026.31 - Upgrade
Upgrade
ubuntu/linux-kvmto a version that resolves this vulnerability.Fixed in 5.15.0-1029.34 - Upgrade
Upgrade
ubuntu/linux-lowlatencyto a version that resolves this vulnerability.Fixed in 5.15.0-67.74 - Upgrade
Upgrade
ubuntu/linux-lowlatency-hwe-5.19to a version that resolves this vulnerability.Fixed in 5.19.0-1018.19~22.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidiato a version that resolves this vulnerability.Fixed in 5.15.0-1023.23 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 5.15.0-1030.36 - Upgrade
Upgrade
ubuntu/linux-raspito a version that resolves this vulnerability.Fixed in 5.15.0-1025.27 - Upgrade
Upgrade
ubuntu/linux-bluefieldto a version that resolves this vulnerability.Fixed in 5.15.0-1014.16 - Upgrade
Upgrade
ubuntu/linux-intel-iot-realtimeto a version that resolves this vulnerability.Fixed in 5.15.0-1022.27 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 5.15.0-1033.36
Event History
Frequently Asked Questions
What is the severity of CVE-2022-3169?
CVE-2022-3169 is classified as a denial of service vulnerability affecting the Linux kernel.
How do I fix CVE-2022-3169?
To mitigate CVE-2022-3169, update your Linux kernel to version 5.10.223-1, 5.10.226-1, 6.1.119-1, 6.1.123-1, 6.12.11-1, or 6.12.12-1.
What systems are affected by CVE-2022-3169?
CVE-2022-3169 affects specific Linux kernel versions and distributions such as Linux kernel 4.19, Fedora 36, and Debian 10.0.
What kind of vulnerability is CVE-2022-3169?
CVE-2022-3169 is a denial of service (DoS) vulnerability that can cause a PCIe link disconnect.
Is CVE-2022-3169 a critical vulnerability?
While CVE-2022-3169 may lead to service interruptions, it does not allow for remote code execution or data breach, therefore, its criticality depends on the specific environment.