In the Linux kernel, the following vulnerability has been resolved:
nvmet: fix a use-after-free
Fix the following use-after-free complaint triggered by blktests nvme/004:
BUG: KASAN: user-memory-access in blkmqcompleterequestremote+0xac/0x350 Read of size 4 at addr 0000607bd1835943 by task kworker/13:1/460 Workqueue: nvmet-wq nvmeloopexecutework [nvmeloop] Call Trace: showstack+0x52/0x58 dumpstacklvl+0x49/0x5e printreport.cold+0x36/0x1e2 kasanreport+0xb9/0xf0 _asanload4+0x6b/0x80 blkmqcompleterequestremote+0xac/0x350 nvmeloopqueueresponse+0x1df/0x275 [nvmeloop] _nvmetreqcomplete+0x132/0x4f0 [nvmet] nvmetreqcomplete+0x15/0x40 [nvmet] nvmetexecuteioconnect+0x18a/0x1f0 [nvmet] nvmeloopexecutework+0x20/0x30 [nvmeloop] processonework+0x56e/0xa70 workerthread+0x2d1/0x640 kthread+0x183/0x1c0 retfromfork+0x1f/0x30
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6a02a61e81c231cc5c680c5dbf8665275147ac52",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/nvme/target/core.c"
},
"id": "CVE-2022-48697-381c6470",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"174187321517930190681404083518244401527",
"129607526053915564197075600611844619356",
"24612449520524182989030032470537390907",
"304675094122299207146397752623700096515",
"250324718007880046255483293472768123791",
"216258631344686289330623565516296551939",
"275388516857929343854876200176696230936",
"29417911958665348088457240832484854993",
"237753464021734410162097643528806275801",
"244213728531309343392355203245398743684"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ebf46da50beb78066674354ad650606a467e33fa",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "__nvmet_req_complete",
"file": "drivers/nvme/target/core.c"
},
"id": "CVE-2022-48697-3a7bed63",
"signature_type": "Function",
"digest": {
"length": 406.0,
"function_hash": "149002355987233973011222895680288437617"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@17f121ca3ec6be0fb32d77c7f65362934a38cc8e",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/nvme/target/core.c"
},
"id": "CVE-2022-48697-40e54885",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"122844990094997673188010015891583162919",
"119634673014123410307844654285916623930",
"291069880326153898911890428588553419873",
"77748792072133517264966013448639191699",
"83218177549323338139937193727069545283",
"181183636669919336871296187956588481987",
"200536089522042837500787447438745292644",
"29417911958665348088457240832484854993",
"237753464021734410162097643528806275801",
"244213728531309343392355203245398743684"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@17f121ca3ec6be0fb32d77c7f65362934a38cc8e",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "__nvmet_req_complete",
"file": "drivers/nvme/target/core.c"
},
"id": "CVE-2022-48697-49f5b4c2",
"signature_type": "Function",
"digest": {
"length": 600.0,
"function_hash": "267087269299566928816618321243365717454"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4484ce97a78171668c402e0c45db7f760aea8060",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "__nvmet_req_complete",
"file": "drivers/nvme/target/core.c"
},
"id": "CVE-2022-48697-567da22d",
"signature_type": "Function",
"digest": {
"length": 406.0,
"function_hash": "149002355987233973011222895680288437617"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@be01f1c988757b95f11f090a9f491365670a522b",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/nvme/target/core.c"
},
"id": "CVE-2022-48697-7c629ee9",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"174187321517930190681404083518244401527",
"129607526053915564197075600611844619356",
"24612449520524182989030032470537390907",
"304675094122299207146397752623700096515",
"250324718007880046255483293472768123791",
"216258631344686289330623565516296551939",
"275388516857929343854876200176696230936",
"29417911958665348088457240832484854993",
"237753464021734410162097643528806275801",
"244213728531309343392355203245398743684"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@be01f1c988757b95f11f090a9f491365670a522b",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "__nvmet_req_complete",
"file": "drivers/nvme/target/core.c"
},
"id": "CVE-2022-48697-b15a9220",
"signature_type": "Function",
"digest": {
"length": 406.0,
"function_hash": "149002355987233973011222895680288437617"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8d66989b5f7bb28bba2f8e1e2ffc8bfef4a10717",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/nvme/target/core.c"
},
"id": "CVE-2022-48697-d40d7ade",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"174187321517930190681404083518244401527",
"129607526053915564197075600611844619356",
"24612449520524182989030032470537390907",
"304675094122299207146397752623700096515",
"250324718007880046255483293472768123791",
"216258631344686289330623565516296551939",
"275388516857929343854876200176696230936",
"29417911958665348088457240832484854993",
"237753464021734410162097643528806275801",
"244213728531309343392355203245398743684"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6a02a61e81c231cc5c680c5dbf8665275147ac52",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "__nvmet_req_complete",
"file": "drivers/nvme/target/core.c"
},
"id": "CVE-2022-48697-da184119",
"signature_type": "Function",
"digest": {
"length": 406.0,
"function_hash": "149002355987233973011222895680288437617"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4484ce97a78171668c402e0c45db7f760aea8060",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/nvme/target/core.c"
},
"id": "CVE-2022-48697-e5983b0c",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"174187321517930190681404083518244401527",
"129607526053915564197075600611844619356",
"24612449520524182989030032470537390907",
"304675094122299207146397752623700096515",
"250324718007880046255483293472768123791",
"216258631344686289330623565516296551939",
"275388516857929343854876200176696230936",
"29417911958665348088457240832484854993",
"237753464021734410162097643528806275801",
"244213728531309343392355203245398743684"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ebf46da50beb78066674354ad650606a467e33fa",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/nvme/target/core.c"
},
"id": "CVE-2022-48697-f8f0c337",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"174187321517930190681404083518244401527",
"129607526053915564197075600611844619356",
"24612449520524182989030032470537390907",
"304675094122299207146397752623700096515",
"250324718007880046255483293472768123791",
"216258631344686289330623565516296551939",
"275388516857929343854876200176696230936",
"29417911958665348088457240832484854993",
"237753464021734410162097643528806275801",
"244213728531309343392355203245398743684"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8d66989b5f7bb28bba2f8e1e2ffc8bfef4a10717",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "__nvmet_req_complete",
"file": "drivers/nvme/target/core.c"
},
"id": "CVE-2022-48697-ff3b4405",
"signature_type": "Function",
"digest": {
"length": 406.0,
"function_hash": "149002355987233973011222895680288437617"
}
}
]