UBUNTU-CVE-2022-49082: Use After Free

Q: What level of access does an attacker need?

The reported vector requires local access and low privileges, with no user interaction required. The CVSS vector indicates high potential impact to confidentiality, integrity, and availability.

Q: What systems are in scope?

The affected software list includes Ubuntu linux, linux-aws, linux-azure, linux-gcp, linux-gke, linux-hwe-edge, linux-ibm, and linux-kvm packages. The issue is in the mpt3sas SCSI driver path.

Q: When might this issue be observed operationally?

The supplied report shows the use-after-free during removal of the mpt3sas driver module, such as an rmmod operation. KASAN reports a use-after-free in _scsih_expander_node_remove().

Published Feb 26, 2025

Updated

In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Fix use after free in scsihexpandernoderemove() The function mpt3sastransportportremove() called in scsihexpandernoderemove() frees the port field of the sasexpander structure, leading to the following use-after-free splat from KASAN when the iocinfo() call following that function is executed (e.g. when doing rmmod of the driver module): [ 3479.371167] ================================================================== [ 3479.378496] BUG: KASAN: use-after-free in scsihexpandernoderemove+0x710/0x750 [mpt3sas] [ 3479.386936] Read of size 1 at addr ffff8881c037691c by task rmmod/1531 [ 3479.393524] [ 3479.395035] CPU: 18 PID: 1531 Comm: rmmod Not tainted 5.17.0-rc8+ #1436 [ 3479.401712] Hardware name: Supermicro Super Server/H12SSL-NT, BIOS 2.1 06/02/2021 [ 3479.409263] Call Trace: [ 3479.411743] <TASK> [ 3479.413875] dumpstacklvl+0x45/0x59 [ 3479.417582] printaddressdescription.constprop.0+0x1f/0x120 [ 3479.423389] ? scsihexpandernoderemove+0x710/0x750 [mpt3sas] [ 3479.429469] kasanreport.cold+0x83/0xdf [ 3479.433438] ? scsihexpandernoderemove+0x710/0x750 [mpt3sas] [ 3479.439514] scsihexpandernoderemove+0x710/0x750 [mpt3sas] [ 3479.445411] ? rawspinunlockirqrestore+0x2d/0x40 [ 3479.452032] scsihremove+0x525/0xc90 [mpt3sas] [ 3479.458212] ? mpt3sasexpanderremove+0x1d0/0x1d0 [mpt3sas] [ 3479.465529] ? downwrite+0xde/0x150 [ 3479.470746] ? upwrite+0x14d/0x460 [ 3479.475840] ? kernfsfindns+0x137/0x310 [ 3479.481438] pcideviceremove+0x65/0x110 [ 3479.487013] devicereleasedriver+0x316/0x680 [ 3479.493180] driverdetach+0x1ec/0x2d0 [ 3479.498499] busremovedriver+0xe7/0x2d0 [ 3479.504081] pciunregisterdriver+0x26/0x250 [ 3479.510033] mpt3sasexit+0x2b/0x6cf [mpt3sas] [ 3479.516144] x64sysdeletemodule+0x2fd/0x510 [ 3479.522315] ? freemodule+0xaa0/0xaa0 [ 3479.527593] ? condresched+0x1c/0x90 [ 3479.532951] ? lockdephardirqsonprepare+0x273/0x3e0 [ 3479.539607] ? syscallenterfromusermode+0x21/0x70 [ 3479.546161] ? tracehardirqson+0x1c/0x110 [ 3479.551828] dosyscall64+0x35/0x80 [ 3479.556884] entrySYSCALL64afterhwframe+0x44/0xae [ 3479.563402] RIP: 0033:0x7f1fc482483b ... [ 3479.943087] ================================================================== Fix this by introducing the local variable portid to store the port ID value before executing mpt3sastransportportremove(). This local variable is then used in the call to iocinfo() instead of dereferencing the freed port structure.

Affected Software

117 affected componentsFixes available

ubuntu/linux-hwe-edge*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-aws-5.4*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-5.4<5.4.0-1171.177~18.04.1

5.4.0-1171.177~18.04.1

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gcp-5.4<5.4.0-1169.179~18.04.1

5.4.0-1169.179~18.04.1

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-5.4<5.4.0-244.264~18.04.1

5.4.0-244.264~18.04.1

ubuntu/linux-hwe-edge*

ubuntu/linux-ibm-5.4<5.4.0-1112.117~18.04.1

5.4.0-1112.117~18.04.1

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-oracle-5.4<5.4.0-1164.174~18.04.1

5.4.0-1164.174~18.04.1

ubuntu/linux-raspi-5.4*

ubuntu/linux-azure-5.15<5.15.0-1008.9~20.04.1

5.15.0-1008.9~20.04.1

ubuntu/linux-hwe-5.15<5.15.0-41.44~20.04.1

5.15.0-41.44~20.04.1

ubuntu/linux-intel-iotg-5.15<5.15.0-1008.11~20.04.1

5.15.0-1008.11~20.04.1

ubuntu/linux-lowlatency-hwe-5.15<5.15.0-42.45~20.04.1

5.15.0-42.45~20.04.1

ubuntu/linux<5.4.0-244.264

5.4.0-244.264

ubuntu/linux-aws<5.4.0-1166.177

5.4.0-1166.177

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure<5.4.0-1171.177

5.4.0-1171.177

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-bluefield<5.4.0-1125.132

5.4.0-1125.132

ubuntu/linux-gcp<5.4.0-1169.179

5.4.0-1169.179

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.8*

ubuntu/linux-ibm<5.4.0-1112.117

5.4.0-1112.117

ubuntu/linux-intel-5.13*

ubuntu/linux-iot<5.4.0-1070.73

5.4.0-1070.73

ubuntu/linux-kvm<5.4.0-1153.162

5.4.0-1153.162

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle<5.4.0-1164.174

5.4.0-1164.174

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.8*

ubuntu/linux-xilinx-zynqmp<5.4.0-1084.88

5.4.0-1084.88

ubuntu/linux-aws-fips<5.4.0-1166.177+fips1

5.4.0-1166.177+fips1

ubuntu/linux-azure-fips<5.4.0-1171.177+fips1

5.4.0-1171.177+fips1

ubuntu/linux-fips<5.4.0-1140.150

5.4.0-1140.150

ubuntu/linux-gcp-fips<5.4.0-1169.179+fips1

5.4.0-1169.179+fips1

ubuntu/linux-fips*

ubuntu/linux<5.15.0-37.39

5.15.0-37.39

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws<5.15.0-1011.14

5.15.0-1011.14

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-azure<5.15.0-1010.12

5.15.0-1010.12

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-gcp<5.15.0-1008.12

5.15.0-1008.12

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-gke<5.15.0-1008.10

5.15.0-1008.10

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-ibm<5.15.0-1007.8

5.15.0-1007.8

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-intel-iotg<5.15.0-1008.11

5.15.0-1008.11

ubuntu/linux-kvm<5.15.0-1010.11

5.15.0-1010.11

ubuntu/linux-lowlatency<5.15.0-37.39

5.15.0-37.39

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle<5.15.0-1009.12

5.15.0-1009.12

ubuntu/linux-oracle-6.5*

ubuntu/linux-raspi<5.15.0-1011.13

5.15.0-1011.13

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-realtime<5.15.0-1014.14

5.15.0-1014.14

ubuntu/linux-raspi-realtime*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-azure-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1171.177~18.04.1
Upgrade
Upgrade ubuntu/linux-gcp-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1169.179~18.04.1
Upgrade
Upgrade ubuntu/linux-hwe-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-244.264~18.04.1
Upgrade
Upgrade ubuntu/linux-ibm-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1112.117~18.04.1
Upgrade
Upgrade ubuntu/linux-oracle-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1164.174~18.04.1
Upgrade
Upgrade ubuntu/linux-azure-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1008.9~20.04.1
Upgrade
Upgrade ubuntu/linux-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-41.44~20.04.1
Upgrade
Upgrade ubuntu/linux-intel-iotg-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1008.11~20.04.1
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-42.45~20.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 5.4.0-244.264
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 5.4.0-1166.177
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.4.0-1171.177
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 5.4.0-1125.132
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 5.4.0-1169.179
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 5.4.0-1112.117
Upgrade
Upgrade ubuntu/linux-iot to a version that resolves this vulnerability.
Fixed in 5.4.0-1070.73
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 5.4.0-1153.162
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 5.4.0-1164.174
Upgrade
Upgrade ubuntu/linux-xilinx-zynqmp to a version that resolves this vulnerability.
Fixed in 5.4.0-1084.88
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1166.177+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1171.177+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1140.150
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1169.179+fips1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 5.15.0-37.39
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 5.15.0-1011.14
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.15.0-1010.12
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 5.15.0-1008.12
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 5.15.0-1008.10
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 5.15.0-1007.8
Upgrade
Upgrade ubuntu/linux-intel-iotg to a version that resolves this vulnerability.
Fixed in 5.15.0-1008.11
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 5.15.0-1010.11
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 5.15.0-37.39
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 5.15.0-1009.12
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 5.15.0-1011.13
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 5.15.0-1014.14
Compensating control
In _scsih_expander_node_remove(), introduce a local variable port_id to store the port ID before calling mpt3sas_transport_port_remove(), then use port_id in the subsequent ioc_info() call instead of dereferencing the freed port structure.

Event History

Feb 26, 2025

CVE Published

via OSV·07:00 AM

Data Sourced

via OSV·07:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What level of access does an attacker need?

The reported vector requires local access and low privileges, with no user interaction required. The CVSS vector indicates high potential impact to confidentiality, integrity, and availability.

What systems are in scope?