CVE-2022-48666

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-48666
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-48666.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-48666
Downstream
Published
2024-04-28T13:01:50.526Z
Modified
2026-03-14T11:56:15.754130Z
Severity
  • 7.4 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
scsi: core: Fix a use-after-free
Details

In the Linux kernel, the following vulnerability has been resolved:

scsi: core: Fix a use-after-free

There are two .exitcmdpriv implementations. Both implementations use resources associated with the SCSI host. Make sure that these resources are still available when .exitcmdpriv is called by waiting inside scsiremovehost() until the tag set has been freed.

This commit fixes the following use-after-free:

================================================================== BUG: KASAN: use-after-free in srpexitcmdpriv+0x27/0xd0 [ibsrp] Read of size 8 at addr ffff888100337000 by task multipathd/16727 Call Trace: <TASK> dumpstacklvl+0x34/0x44 printreport.cold+0x5e/0x5db kasanreport+0xab/0x120 srpexitcmdpriv+0x27/0xd0 [ibsrp] scsimqexitrequest+0x4d/0x70 blkmqfreerqs+0x143/0x410 __blkmqfree_mapandrqs+0x6e/0x100 blkmqfreetagset+0x2b/0x160 scsihostdevrelease+0xf3/0x1a0 devicerelease+0x54/0xe0 kobjectput+0xa5/0x120 devicerelease+0x54/0xe0 kobjectput+0xa5/0x120 scsidevicedevreleaseusercontext+0x4c1/0x4e0 executeinprocesscontext+0x23/0x90 devicerelease+0x54/0xe0 kobjectput+0xa5/0x120 scsidiskrelease+0x3f/0x50 devicerelease+0x54/0xe0 kobjectput+0xa5/0x120 diskrelease+0x17f/0x1b0 devicerelease+0x54/0xe0 kobjectput+0xa5/0x120 dmputtabledevice+0xa3/0x160 [dmmod] dmputdevice+0xd0/0x140 [dmmod] freeprioritygroup+0xd8/0x110 [dmmultipath] freemultipath+0x94/0xe0 [dmmultipath] dmtabledestroy+0xa2/0x1e0 [dmmod] __dmdestroy+0x196/0x350 [dmmod] dev_remove+0x10c/0x160 [dmmod] ctlioctl+0x2c2/0x590 [dmmod] dmctlioctl+0x5/0x10 [dmmod] __x64sysioctl+0xb4/0xf0 dm_ctlioctl+0x5/0x10 [dmmod] __x64sysioctl+0xb4/0xf0 dosyscall64+0x3b/0x90 entrySYSCALL64afterhwframe+0x46/0xb0

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48666.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
65ca846a53149a1a72cd8d02e7b2e73dd545b834
Fixed
5ce8fad941233e81f2afb5b52a3fcddd3ba8732f
Fixed
f818708eeeae793e12dc39f8984ed7732048a7d9
Fixed
2e7eb4c1e8af8385de22775bd0be552f59b28c9a
Fixed
8fe4ce5836e932f5766317cb651c1ff2a4cd0506

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-48666.json"