CVE-2022-48974: netfilter: conntrack: fix using __this_cpu_add in preemptible
In the Linux kernel, the following vulnerability has been resolved:
netfilter: conntrack: fix using thiscpuadd in preemptible
Currently in nfconntrackhashcheckinsert(), when it fails in nfctextvalidpre/post(), NFCTSTATINC() will be called in the preemptible context, a call trace can be triggered:
BUG: using thiscpuadd() in preemptible [00000000] code: conntrack/1636 caller is nfconntrackhashcheckinsert+0x45/0x430 [nfconntrack] Call Trace: <TASK> dumpstacklvl+0x33/0x46 checkpreemptiondisabled+0xc3/0xf0 nfconntrackhashcheckinsert+0x45/0x430 [nfconntrack] ctnetlinkcreateconntrack+0x3cd/0x4e0 [nfconntracknetlink] ctnetlinknewconntrack+0x1c0/0x450 [nfconntracknetlink] nfnetlinkrcvmsg+0x277/0x2f0 [nfnetlink] netlinkrcvskb+0x50/0x100 nfnetlinkrcv+0x65/0x144 [nfnetlink] netlinkunicast+0x1ae/0x290 netlinksendmsg+0x257/0x4f0 socksendmsg+0x5f/0x70
This patch is to fix it by changing to use NFCTSTATINCATOMIC() for nfctextvalidpre/post() check in nfconntrackhashcheckinsert(), as well as nfctextvalidpost() in nfconntrackconfirm().
Note that nfctextvalidpre() check in nfconntrackconfirm() is safe to use NFCTSTATINC(), as it's under localbhdisable().
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-48974?
The CVE-2022-48974 vulnerability is classified as medium severity.
How do I fix CVE-2022-48974?
To resolve CVE-2022-48974, you should update your Linux kernel to version 6.0.13 or later.
Which versions of Linux are affected by CVE-2022-48974?
CVE-2022-48974 affects the Linux kernel versions from 5.19 up to 6.0.13, as well as various 6.1 release candidates.
Is CVE-2022-48974 a remote exploit?
CVE-2022-48974 is not primarily a remote exploit but can be exploited in a local context due to its nature.
What components are involved in the CVE-2022-48974 vulnerability?
The vulnerability involves the netfilter conntrack component in the Linux kernel.