CVE-2022-48697: nvmet: fix a use-after-free
In the Linux kernel, the following vulnerability has been resolved:
nvmet: fix a use-after-free
Fix the following use-after-free complaint triggered by blktests nvme/004:
BUG: KASAN: user-memory-access in blkmqcompleterequestremote+0xac/0x350 Read of size 4 at addr 0000607bd1835943 by task kworker/13:1/460 Workqueue: nvmet-wq nvmeloopexecutework [nvmeloop] Call Trace: showstack+0x52/0x58 dumpstacklvl+0x49/0x5e printreport.cold+0x36/0x1e2 kasanreport+0xb9/0xf0 asanload4+0x6b/0x80 blkmqcompleterequestremote+0xac/0x350 nvmeloopqueueresponse+0x1df/0x275 [nvmeloop] nvmetreqcomplete+0x132/0x4f0 [nvmet] nvmetreqcomplete+0x15/0x40 [nvmet] nvmetexecuteioconnect+0x18a/0x1f0 [nvmet] nvmeloopexecutework+0x20/0x30 [nvmeloop] processonework+0x56e/0xa70 workerthread+0x2d1/0x640 kthread+0x183/0x1c0 retfromfork+0x1f/0x30
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-48697?
CVE-2022-48697 is classified as a high severity vulnerability due to its potential to cause a use-after-free condition.
How do I fix CVE-2022-48697?
To fix CVE-2022-48697, you should update the Linux kernel to the latest version that patches this vulnerability.
What systems are affected by CVE-2022-48697?
CVE-2022-48697 affects several versions of the Linux kernel, including versions from 4.8 to 6.0-rc4.
What type of vulnerability is CVE-2022-48697?
CVE-2022-48697 is a use-after-free vulnerability found in the Linux kernel.
What are the potential impacts of CVE-2022-48697?
The potential impacts of CVE-2022-48697 include crashes, system instability, or the possibility of remote code execution.