CVE-2022-48666

Source
https://nvd.nist.gov/vuln/detail/CVE-2022-48666
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-48666.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-48666
Related
Published
2024-04-28T13:15:08Z
Modified
2024-09-18T03:22:32.462047Z
Summary
[none]
Details

In the Linux kernel, the following vulnerability has been resolved:

scsi: core: Fix a use-after-free

There are two .exitcmdpriv implementations. Both implementations use resources associated with the SCSI host. Make sure that these resources are still available when .exitcmdpriv is called by waiting inside scsiremovehost() until the tag set has been freed.

This commit fixes the following use-after-free:

================================================================== BUG: KASAN: use-after-free in srpexitcmdpriv+0x27/0xd0 [ibsrp] Read of size 8 at addr ffff888100337000 by task multipathd/16727 Call Trace: <TASK> dumpstacklvl+0x34/0x44 printreport.cold+0x5e/0x5db kasanreport+0xab/0x120 srpexitcmdpriv+0x27/0xd0 [ibsrp] scsimqexitrequest+0x4d/0x70 blkmqfreerqs+0x143/0x410 _blkmqfreemapandrqs+0x6e/0x100 blkmqfreetagset+0x2b/0x160 scsihostdevrelease+0xf3/0x1a0 devicerelease+0x54/0xe0 kobjectput+0xa5/0x120 devicerelease+0x54/0xe0 kobjectput+0xa5/0x120 scsidevicedevreleaseusercontext+0x4c1/0x4e0 executeinprocesscontext+0x23/0x90 devicerelease+0x54/0xe0 kobjectput+0xa5/0x120 scsidiskrelease+0x3f/0x50 devicerelease+0x54/0xe0 kobjectput+0xa5/0x120 diskrelease+0x17f/0x1b0 devicerelease+0x54/0xe0 kobjectput+0xa5/0x120 dmputtabledevice+0xa3/0x160 [dmmod] dmputdevice+0xd0/0x140 [dmmod] freeprioritygroup+0xd8/0x110 [dmmultipath] freemultipath+0x94/0xe0 [dmmultipath] dmtabledestroy+0xa2/0x1e0 [dmmod] _dmdestroy+0x196/0x350 [dmmod] devremove+0x10c/0x160 [dmmod] ctlioctl+0x2c2/0x590 [dmmod] dmctlioctl+0x5/0x10 [dmmod] _x64sysioctl+0xb4/0xf0 dmctlioctl+0x5/0x10 [dmmod] _x64sysioctl+0xb4/0xf0 dosyscall64+0x3b/0x90 entrySYSCALL64after_hwframe+0x46/0xb0

References

Affected packages

Debian:11 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.10.223-1

Affected versions

5.*

5.10.46-4
5.10.46-5
5.10.70-1~bpo10+1
5.10.70-1
5.10.84-1
5.10.92-1~bpo10+1
5.10.92-1
5.10.92-2
5.10.103-1~bpo10+1
5.10.103-1
5.10.106-1
5.10.113-1
5.10.120-1~bpo10+1
5.10.120-1
5.10.127-1
5.10.127-2~bpo10+1
5.10.127-2
5.10.136-1
5.10.140-1
5.10.148-1
5.10.149-1
5.10.149-2
5.10.158-1
5.10.158-2
5.10.162-1
5.10.178-1
5.10.178-2
5.10.178-3
5.10.179-1
5.10.179-2
5.10.179-3
5.10.179-4
5.10.179-5
5.10.191-1
5.10.197-1
5.10.205-1
5.10.205-2
5.10.209-1
5.10.209-2
5.10.216-1
5.10.218-1
5.10.221-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.0.2-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.0.2-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}