CVE-2022-48666: scsi: core: Fix a use-after-free
In the Linux kernel, the following vulnerability has been resolved:
scsi: core: Fix a use-after-free
There are two .exitcmdpriv implementations. Both implementations use resources associated with the SCSI host. Make sure that these resources are still available when .exitcmdpriv is called by waiting inside scsiremovehost() until the tag set has been freed.
This commit fixes the following use-after-free:
================================================================== BUG: KASAN: use-after-free in srpexitcmdpriv+0x27/0xd0 [ibsrp] Read of size 8 at addr ffff888100337000 by task multipathd/16727 Call Trace: <TASK> dumpstacklvl+0x34/0x44 printreport.cold+0x5e/0x5db kasanreport+0xab/0x120 srpexitcmdpriv+0x27/0xd0 [ibsrp] scsimqexitrequest+0x4d/0x70 blkmqfreerqs+0x143/0x410 blkmqfreemapandrqs+0x6e/0x100 blkmqfreetagset+0x2b/0x160 scsihostdevrelease+0xf3/0x1a0 devicerelease+0x54/0xe0 kobjectput+0xa5/0x120 devicerelease+0x54/0xe0 kobjectput+0xa5/0x120 scsidevicedevreleaseusercontext+0x4c1/0x4e0 executeinprocesscontext+0x23/0x90 devicerelease+0x54/0xe0 kobjectput+0xa5/0x120 scsidiskrelease+0x3f/0x50 devicerelease+0x54/0xe0 kobjectput+0xa5/0x120 diskrelease+0x17f/0x1b0 devicerelease+0x54/0xe0 kobjectput+0xa5/0x120 dmputtabledevice+0xa3/0x160 [dmmod] dmputdevice+0xd0/0x140 [dmmod] freeprioritygroup+0xd8/0x110 [dmmultipath] freemultipath+0x94/0xe0 [dmmultipath] dmtabledestroy+0xa2/0x1e0 [dmmod] dmdestroy+0x196/0x350 [dmmod] devremove+0x10c/0x160 [dmmod] ctlioctl+0x2c2/0x590 [dmmod] dmctlioctl+0x5/0x10 [dmmod] x64sysioctl+0xb4/0xf0 dmctlioctl+0x5/0x10 [dmmod] x64sysioctl+0xb4/0xf0 dosyscall64+0x3b/0x90 entrySYSCALL64afterhwframe+0x46/0xb0
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.0.2-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
Event History
Frequently Asked Questions
What is the severity of CVE-2022-48666?
CVE-2022-48666 has a medium severity rating due to its nature as a use-after-free vulnerability in the Linux kernel.
How do I fix CVE-2022-48666?
To fix CVE-2022-48666, update your Linux kernel to the patched versions: 5.10.223-1, 5.10.234-1, 6.1.123-1, 6.1.128-1, or 6.12.17-1.
Which systems are affected by CVE-2022-48666?
CVE-2022-48666 affects Linux kernel versions prior to the patches released for the specified versions.
What type of vulnerability is CVE-2022-48666?
CVE-2022-48666 is a use-after-free vulnerability, which can lead to potential code execution or system crashes.
Is CVE-2022-48666 being actively exploited?
As of now, there is no public information indicating that CVE-2022-48666 is being actively exploited in the wild.