CVE-2022-49789: scsi: zfcp: Fix double free of FSF request when qdio send fails

Q: What level of access and complexity does exploitation require?

The severity vector indicates that exploitation requires local access and low privileges, with high attack complexity. No user interaction is required.

Q: What runtime condition leads to the unsafe cleanup path?

The issue occurs when sending a new FSF request through QDIO fails and the driver removes the request from its internal hash table. A truncated or sign-extended cached request ID can fail to match the original ID, leading to an invalid reference during later cleanup and a double free.

Q: When can the cached request ID stop matching the original request ID?

A mismatch can occur once the request ID exceeds 32 bits due to truncation. It can also occur when bit 32 is set, starting at 0x80000000, because the ID was cached in a signed 32-bit integer and later converted back to an unsigned long.

Published May 1, 2025

Updated

In the Linux kernel, the following vulnerability has been resolved:

scsi: zfcp: Fix double free of FSF request when qdio send fails

We used to use the wrong type of integer in 'zfcpfsfreqsend()' to cache the FSF request ID when sending a new FSF request. This is used in case the sending fails and we need to remove the request from our internal hash table again (so we don't keep an invalid reference and use it when we free the request again).

In 'zfcpfsfreqsend()' we used to cache the ID as 'int' (signed and 32 bit wide), but the rest of the zfcp code (and the firmware specification) handles the ID as 'unsigned long'/'u64' (unsigned and 64 bit wide [s390x ELF ABI]). For one this has the obvious problem that when the ID grows past 32 bit (this can happen reasonably fast) it is truncated to 32 bit when storing it in the cache variable and so doesn't match the original ID anymore. The second less obvious problem is that even when the original ID has not yet grown past 32 bit, as soon as the 32nd bit is set in the original ID (0x80000000 = 2'147'483'648) we will have a mismatch when we cast it back to 'unsigned long'. As the cached variable is of a signed type, the compiler will choose a sign-extending instruction to load the 32 bit variable into a 64 bit register (e.g.: 'lgf %r11,188(%r15)'). So once we pass the cached variable into 'zfcpreqlistfindrm()' to remove the request again all the leading zeros will be flipped to ones to extend the sign and won't match the original ID anymore (this has been observed in practice).

If we can't successfully remove the request from the hash table again after 'zfcpqdiosend()' fails (this happens regularly when zfcp cannot notify the adapter about new work because the adapter is already gone during e.g. a ChpID toggle) we will end up with a double free. We unconditionally free the request in the calling function when 'zfcpfsfreqsend()' fails, but because the request is still in the hash table we end up with a stale memory reference, and once the zfcp adapter is either reset during recovery or shutdown we end up freeing the same memory twice.

The resulting stack traces vary depending on the kernel and have no direct correlation to the place where the bug occurs. Here are three examples that have been seen in practice:

listdel corruption. next->prev should be 00000001b9d13800, but was 00000000dead4ead. (next=00000001bd131a00) ------------[ cut here ]------------ kernel BUG at lib/listdebug.c:62! monitor event: 0040 ilc:2 [#1] PREEMPT SMP Modules linked in: ... CPU: 9 PID: 1617 Comm: zfcperp0.0.1740 Kdump: loaded Hardware name: ... Krnl PSW : 0704d00180000000 00000003cbeea1f8 (listdelentryvalid+0x98/0x140) R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:1 PM:0 RI:0 EA:3 Krnl GPRS: 00000000916d12f1 0000000080000000 000000000000006d 00000003cb665cd6 0000000000000001 0000000000000000 0000000000000000 00000000d28d21e8 00000000d3844000 00000380099efd28 00000001bd131a00 00000001b9d13800 00000000d3290100 0000000000000000 00000003cbeea1f4 00000380099efc70 Krnl Code: 00000003cbeea1e8: c020004f68a7 larl %r2,00000003cc8d7336 00000003cbeea1ee: c0e50027fd65 brasl %r14,00000003cc3e9cb8 #00000003cbeea1f4: af000000 mc 0,0 >00000003cbeea1f8: c02000920440 larl %r2,00000003cd12aa78 00000003cbeea1fe: c0e500289c25 brasl %r14,00000003cc3fda48 00000003cbeea204: b9040043 lgr %r4,%r3 00000003cbeea208: b9040051 lgr %r5,%r1 00000003cbeea20c: b9040032 lgr %r3,%r2 Call Trace: [<00000003cbeea1f8>] listdelentryvalid+0x98/0x140 ([<00000003cbeea1f4>] listdelentryvalid+0x94/0x140) [<000003ff7ff502fe>] zfcpfsfreqdismissall+0xde/0x150 [zfcp] [<000003ff7ff49cd0>] zfcperpstrategydoaction+0x160/0x280 [zfcp] ---truncated---

Affected Software

173 affected componentsFixes available

Linux Kernel

Linux Linux kernel>=2.6.34<5.4.225

Linux Linux kernel>=5.5<5.10.156

Linux Linux kernel>=5.11<5.15.80

Linux Linux kernel>=5.16<6.0.10

Linux Linux kernel=6.1-rc1

Linux Linux kernel=6.1-rc2

Linux Linux kernel=6.1-rc3

Linux Linux kernel=6.1-rc4

Linux Linux kernel=6.1-rc5

debian/linux<6.0.10-1

6.0.10-1

debian/linux<6.0.10-1

6.0.10-1

debian/linux<6.0.10-1

6.0.10-1

debian/linux

6.1.176-16.1.190-16.12.107-16.12.115-27.2.12-17.2.15-1

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-azure*

ubuntu/linux-lts-xenial*

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-aws-hwe*

ubuntu/linux-azure*

ubuntu/linux-gcp*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-kvm*

ubuntu/linux-oracle*

ubuntu/linux-fips*

ubuntu/linux-aws-5.4<5.4.0-1097.105~18.04.1

5.4.0-1097.105~18.04.1

ubuntu/linux-azure-5.4<5.4.0-1104.110~18.04.1

5.4.0-1104.110~18.04.1

ubuntu/linux-gcp-5.4<5.4.0-1101.110~18.04.1

5.4.0-1101.110~18.04.1

ubuntu/linux-hwe-5.4<5.4.0-144.161~18.04.1

5.4.0-144.161~18.04.1

ubuntu/linux-ibm-5.4<5.4.0-1045.50~18.04.1

5.4.0-1045.50~18.04.1

ubuntu/linux-oracle-5.4<5.4.0-1094.103~18.04.1

5.4.0-1094.103~18.04.1

ubuntu/linux-raspi-5.4<5.4.0-1081.92~18.04.1

5.4.0-1081.92~18.04.1

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-4.15*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-4.15*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-kvm*

ubuntu/linux-oem*

ubuntu/linux-oracle*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux<5.4.0-144.161

5.4.0-144.161

ubuntu/linux-aws<5.4.0-1097.105

5.4.0-1097.105

ubuntu/linux-aws-5.15<5.15.0-1031.35~20.04.1

5.15.0-1031.35~20.04.1

ubuntu/linux-azure<5.4.0-1104.110

5.4.0-1104.110

ubuntu/linux-azure-5.15<5.15.0-1034.41~20.04.1

5.15.0-1034.41~20.04.1

ubuntu/linux-bluefield<5.4.0-1059.65

5.4.0-1059.65

ubuntu/linux-gcp<5.4.0-1101.110

5.4.0-1101.110

ubuntu/linux-gcp-5.15<5.15.0-1030.37~20.04.1

5.15.0-1030.37~20.04.1

ubuntu/linux-hwe-5.15<5.15.0-67.74~20.04.1

5.15.0-67.74~20.04.1

ubuntu/linux-ibm<5.4.0-1045.50

5.4.0-1045.50

ubuntu/linux-intel-iotg-5.15<5.15.0-1026.31~20.04.1

5.15.0-1026.31~20.04.1

ubuntu/linux-iot<5.4.0-1013.15

5.4.0-1013.15

ubuntu/linux-kvm<5.4.0-1087.93

5.4.0-1087.93

ubuntu/linux-lowlatency-hwe-5.15<5.15.0-67.74~20.04.1

5.15.0-67.74~20.04.1

ubuntu/linux-nvidia-tegra-5.15<5.15.0-1014.14~20.04.1

5.15.0-1014.14~20.04.1

ubuntu/linux-oracle<5.4.0-1094.103

5.4.0-1094.103

ubuntu/linux-oracle-5.15<5.15.0-1030.36~20.04.1

5.15.0-1030.36~20.04.1

ubuntu/linux-raspi<5.4.0-1081.92

5.4.0-1081.92

ubuntu/linux-riscv-5.15<5.15.0-1030.34~20.04.1

5.15.0-1030.34~20.04.1

ubuntu/linux-xilinx-zynqmp<5.4.0-1022.26

5.4.0-1022.26

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.8*

ubuntu/linux-intel-5.13*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.8*

ubuntu/linux-aws-fips<5.4.0-1099.107+fips1

5.4.0-1099.107+fips1

ubuntu/linux-azure-fips<5.4.0-1104.110+fips1

5.4.0-1104.110+fips1

ubuntu/linux-fips<5.4.0-1073.82

5.4.0-1073.82

ubuntu/linux-gcp-fips<5.4.0-1101.110+fips1

5.4.0-1101.110+fips1

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux<5.15.0-67.74

5.15.0-67.74

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws<5.15.0-1031.35

5.15.0-1031.35

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-azure<5.15.0-1034.41

5.15.0-1034.41

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-fde<5.15.0-1034.41.1

5.15.0-1034.41.1

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-gcp<5.15.0-1030.37

5.15.0-1030.37

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-gke<5.15.0-1028.33

5.15.0-1028.33

ubuntu/linux-gkeop<5.15.0-1016.21

5.15.0-1016.21

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-ibm<5.15.0-1026.29

5.15.0-1026.29

ubuntu/linux-intel-iotg<5.15.0-1026.31

5.15.0-1026.31

ubuntu/linux-kvm<5.15.0-1029.34

5.15.0-1029.34

ubuntu/linux-lowlatency<5.15.0-67.74

5.15.0-67.74

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-nvidia<5.15.0-1023.23

5.15.0-1023.23

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle<5.15.0-1030.36

5.15.0-1030.36

ubuntu/linux-oracle-6.5*

ubuntu/linux-raspi<5.15.0-1025.27

5.15.0-1025.27

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-bluefield<5.15.0-1014.16

5.15.0-1014.16

ubuntu/linux-intel-iot-realtime<5.15.0-1022.27

5.15.0-1022.27

ubuntu/linux-realtime<5.15.0-1033.36

5.15.0-1033.36

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 6.0.10-1
Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
Upgrade
Upgrade ubuntu/linux-aws-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1097.105~18.04.1
Upgrade
Upgrade ubuntu/linux-azure-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1104.110~18.04.1
Upgrade
Upgrade ubuntu/linux-gcp-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1101.110~18.04.1
Upgrade
Upgrade ubuntu/linux-hwe-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-144.161~18.04.1
Upgrade
Upgrade ubuntu/linux-ibm-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1045.50~18.04.1
Upgrade
Upgrade ubuntu/linux-oracle-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1094.103~18.04.1
Upgrade
Upgrade ubuntu/linux-raspi-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1081.92~18.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 5.4.0-144.161
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 5.4.0-1097.105
Upgrade
Upgrade ubuntu/linux-aws-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1031.35~20.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.4.0-1104.110
Upgrade
Upgrade ubuntu/linux-azure-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1034.41~20.04.1
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 5.4.0-1059.65
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 5.4.0-1101.110
Upgrade
Upgrade ubuntu/linux-gcp-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1030.37~20.04.1
Upgrade
Upgrade ubuntu/linux-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-67.74~20.04.1
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 5.4.0-1045.50
Upgrade
Upgrade ubuntu/linux-intel-iotg-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1026.31~20.04.1
Upgrade
Upgrade ubuntu/linux-iot to a version that resolves this vulnerability.
Fixed in 5.4.0-1013.15
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 5.4.0-1087.93
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-67.74~20.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1014.14~20.04.1
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 5.4.0-1094.103
Upgrade
Upgrade ubuntu/linux-oracle-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1030.36~20.04.1
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 5.4.0-1081.92
Upgrade
Upgrade ubuntu/linux-riscv-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1030.34~20.04.1
Upgrade
Upgrade ubuntu/linux-xilinx-zynqmp to a version that resolves this vulnerability.
Fixed in 5.4.0-1022.26
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1099.107+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1104.110+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1073.82
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1101.110+fips1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 5.15.0-67.74
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 5.15.0-1031.35
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.15.0-1034.41
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 5.15.0-1034.41.1
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 5.15.0-1030.37
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 5.15.0-1028.33
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 5.15.0-1016.21
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 5.15.0-1026.29
Upgrade
Upgrade ubuntu/linux-intel-iotg to a version that resolves this vulnerability.
Fixed in 5.15.0-1026.31
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 5.15.0-1029.34
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 5.15.0-67.74
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 5.15.0-1023.23
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 5.15.0-1030.36
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 5.15.0-1025.27
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 5.15.0-1014.16
Upgrade
Upgrade ubuntu/linux-intel-iot-realtime to a version that resolves this vulnerability.
Fixed in 5.15.0-1022.27
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 5.15.0-1033.36

Event History

May 1, 2025

CVE Published

via MITRE·02:09 PM

Data Sourced

via MITRE·02:09 PM

DescriptionSeverity

Data Sourced

via OSV·03:16 PM

DescriptionSeverityAffected Software

Data Sourced

via NVD·03:16 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What level of access and complexity does exploitation require?

The severity vector indicates that exploitation requires local access and low privileges, with high attack complexity. No user interaction is required.

What runtime condition leads to the unsafe cleanup path?

The issue occurs when sending a new FSF request through QDIO fails and the driver removes the request from its internal hash table. A truncated or sign-extended cached request ID can fail to match the original ID, leading to an invalid reference during later cleanup and a double free.

When can the cached request ID stop matching the original request ID?

A mismatch can occur once the request ID exceeds 32 bits due to truncation. It can also occur when bit 32 is set, starting at 0x80000000, because the ID was cached in a signed 32-bit integer and later converted back to an unsigned long.

CVE-2022-49789: scsi: zfcp: Fix double free of FSF request when qdio send fails

Affected Software

Remediation

Event History

Frequently Asked Questions

What level of access and complexity does exploitation require?

What runtime condition leads to the unsafe cleanup path?

When can the cached request ID stop matching the original request ID?

Company

Resources

Contact

Frequently Asked Questions

What level of access and complexity does exploitation require?

What runtime condition leads to the unsafe cleanup path?

When can the cached request ID stop matching the original request ID?