CVE-2022-48983: io_uring: Fix a null-ptr-deref in io_tctx_exit_cb()
In the Linux kernel, the following vulnerability has been resolved:
iouring: Fix a null-ptr-deref in iotctxexitcb()
Syzkaller reports a NULL deref bug as follows:
BUG: KASAN: null-ptr-deref in iotctxexitcb+0x53/0xd3 Read of size 4 at addr 0000000000000138 by task file1/1955
CPU: 1 PID: 1955 Comm: file1 Not tainted 6.1.0-rc7-00103-gef4d3ea40565 #75 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014 Call Trace: <TASK> dumpstacklvl+0xcd/0x134 ? iotctxexitcb+0x53/0xd3 kasanreport+0xbb/0x1f0 ? iotctxexitcb+0x53/0xd3 kasancheckrange+0x140/0x190 iotctxexitcb+0x53/0xd3 taskworkrun+0x164/0x250 ? taskworkcancel+0x30/0x30 getsignal+0x1c3/0x2440 ? lockdowngrade+0x6e0/0x6e0 ? lockdowngrade+0x6e0/0x6e0 ? exitsignals+0x8b0/0x8b0 ? dorawreadunlock+0x3b/0x70 ? dorawspinunlock+0x50/0x230 archdosignalorrestart+0x82/0x2470 ? kmemcachefree+0x260/0x4b0 ? putname+0xfe/0x140 ? getsigframesize+0x10/0x10 ? doexecveatcommon.isra.0+0x226/0x710 ? lockdephardirqson+0x79/0x100 ? putname+0xfe/0x140 ? doexecveatcommon.isra.0+0x238/0x710 exittousermodeprepare+0x15f/0x250 syscallexittousermode+0x19/0x50 dosyscall64+0x42/0xb0 entrySYSCALL64afterhwframe+0x63/0xcd RIP: 0023:0x0 Code: Unable to access opcode bytes at 0xffffffffffffffd6. RSP: 002b:00000000fffb7790 EFLAGS: 00000200 ORIGRAX: 000000000000000b RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 </TASK> Kernel panic - not syncing: paniconwarn set ...
This happens because the adding of taskwork from ioringexitwork() isn't synchronized with canceling all work items from eg exec. The execution of the two are ordered in that they are both run by the task itself, but if iotctxexitcb() is queued while we're canceling all work items off exec AND gets executed when the task exits to userspace rather than in the main loop in iouringcancelgeneric(), then we can find current->iouring == NULL and hit the above crash.
It's safe to add this NULL check here, because the execution of the two paths are done by the task itself.
[axboe: add code comment and also put an explanation in the commit msg]
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-48983?
CVE-2022-48983 is classified as a high severity vulnerability due to its potential for causing system crashes.
How do I fix CVE-2022-48983?
To fix CVE-2022-48983, you should update your Linux kernel to version 5.15.84 or later.
What versions of the Linux kernel are affected by CVE-2022-48983?
CVE-2022-48983 affects Linux kernel versions between 5.12 and 5.15.83, as well as version 6.0.13 and various 6.1 release candidates.
What is the nature of the vulnerability described in CVE-2022-48983?
CVE-2022-48983 involves a null pointer dereference issue in the io_tctx_exit_cb function of the Linux kernel.
Can CVE-2022-48983 lead to remote code execution?
CVE-2022-48983 does not lead to remote code execution but may cause denial of service by crashing the kernel.