CVE-2022-48789: nvme-tcp: fix possible use-after-free in transport error_recovery work
In the Linux kernel, the following vulnerability has been resolved:
nvme-tcp: fix possible use-after-free in transport errorrecovery work
While nvmetcpsubmitasynceventwork is checking the ctrl and queue state before preparing the AER command and scheduling iowork, in order to fully prevent a race where this check is not reliable the error recovery work must flush asynceventwork before continuing to destroy the admin queue after setting the ctrl state to RESETTING such that there is no race .submitasyncevent and the error recovery handler itself changing the ctrl state.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Ensure nvme-tcp transport error_recovery flushes async_event_work before continuing to destroy state, so there is no race between nvme_tcp_submit_async_event_work checking ctrl/queue and changing ctrl state (especially after setting ctrl state to RESETTING before preparing the AER command and scheduling io_work).
- Compensating control
In nvme-tcp error recovery, flush async_event_work before preparing the AER command and scheduling io_work to fully prevent a race where the check is not reliable.
Event History
Frequently Asked Questions
What is the severity of CVE-2022-48789?
The severity of CVE-2022-48789 is classified as a moderate vulnerability due to a potential use-after-free condition in the Linux kernel.
How do I fix CVE-2022-48789?
To fix CVE-2022-48789, upgrade your Linux kernel to a version that is later than 5.16.11 or one of the other patched versions mentioned in the security advisories.
Which software versions are affected by CVE-2022-48789?
CVE-2022-48789 affects various Linux kernel versions, specifically those prior to 5.4.181, between 5.5 and 5.10.102, between 5.11 and 5.15.25, and between 5.16 and 5.16.11.
Can CVE-2022-48789 be exploited remotely?
Yes, due to its nature, CVE-2022-48789 could potentially be exploited remotely under certain conditions.
What component of the Linux kernel does CVE-2022-48789 impact?
CVE-2022-48789 impacts the NVMe over TCP transport feature within the Linux kernel.