CVE-2022-48985: net: mana: Fix race on per-CQ variable napi work_done
In the Linux kernel, the following vulnerability has been resolved:
net: mana: Fix race on per-CQ variable napi workdone
After calling napicompletedone(), the NAPIFSTATESCHED bit may be cleared, and another CPU can start napi thread and access per-CQ variable, cq->workdone. If the other thread (for example, from busypoll) sets it to a value >= budget, this thread will continue to run when it should stop, and cause memory corruption and panic.
To fix this issue, save the per-CQ workdone variable in a local variable before napicompletedone(), so it won't be corrupted by a possible concurrent thread after napicompletedone().
Also, add a flag bit to advertise to the NIC firmware: the NAPI workdone variable race is fixed, so the driver is able to reliably support features like busypoll.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-48985?
CVE-2022-48985 has been classified with a severity level that can impact system stability due to its race condition in the Linux kernel.
How do I fix CVE-2022-48985?
To fix CVE-2022-48985, users should update their Linux kernel to a version that includes the patches addressing this vulnerability.
Which versions of the Linux kernel are affected by CVE-2022-48985?
CVE-2022-48985 affects Linux kernel versions from 5.15 through 6.1-rc8.
What is the nature of the issue in CVE-2022-48985?
CVE-2022-48985 involves a race condition that can lead to the improper handling of per-CQ variable 'work_done' during NAPI operations.
Are there any exploitations known for CVE-2022-48985?
As of now, there are no publicly known exploitations of CVE-2022-48985, but the potential for race condition vulnerability poses a risk.