In the Linux kernel, the following vulnerability has been resolved:
nvme-rdma: fix possible use-after-free in transport error_recovery work
While nvmerdmasubmitasynceventwork is checking the ctrl and queue state before preparing the AER command and scheduling iowork, in order to fully prevent a race where this check is not reliable the error recovery work must flush asynceventwork before continuing to destroy the admin queue after setting the ctrl state to RESETTING such that there is no race .submitasyncevent and the error recovery handler itself changing the ctrl state.
{ "vanir_signatures": [ { "digest": { "length": 490.0, "function_hash": "323964871477412315924185841566452498639" }, "target": { "file": "drivers/nvme/host/rdma.c", "function": "nvme_rdma_error_recovery_work" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@324f5bdc52ecb6a6dadb31a62823ef8c709d1439", "signature_version": "v1", "id": "CVE-2022-48788-087c4ce2", "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "125948476036588992742954934907879427317", "109652201163931899279938772266424564153", "145977655902121679879275626162448933837", "56598555705936785387839445251589714898" ] }, "target": { "file": "drivers/nvme/host/rdma.c" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@646952b2210f19e584d2bf9eb5d092abdca2fcc1", "signature_version": "v1", "id": "CVE-2022-48788-397e21a0", "signature_type": "Line" }, { "digest": { "threshold": 0.9, "line_hashes": [ "125948476036588992742954934907879427317", "109652201163931899279938772266424564153", "145977655902121679879275626162448933837", "56598555705936785387839445251589714898" ] }, "target": { "file": "drivers/nvme/host/rdma.c" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b6bb1722f34bbdbabed27acdceaf585d300c5fd2", "signature_version": "v1", "id": "CVE-2022-48788-4038efda", "signature_type": "Line" }, { "digest": { "length": 490.0, "function_hash": "323964871477412315924185841566452498639" }, "target": { "file": "drivers/nvme/host/rdma.c", "function": "nvme_rdma_error_recovery_work" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@646952b2210f19e584d2bf9eb5d092abdca2fcc1", "signature_version": "v1", "id": "CVE-2022-48788-61adfdd8", "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "125948476036588992742954934907879427317", "109652201163931899279938772266424564153", "145977655902121679879275626162448933837", "56598555705936785387839445251589714898" ] }, "target": { "file": "drivers/nvme/host/rdma.c" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d411b2a5da68b8a130c23097014434ac140a2ace", "signature_version": "v1", "id": "CVE-2022-48788-61e8ce90", "signature_type": "Line" }, { "digest": { "length": 482.0, "function_hash": "244910761075627591812400200117594892988" }, "target": { "file": "drivers/nvme/host/rdma.c", "function": "nvme_rdma_error_recovery_work" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ea86027ac467a055849c4945906f799e7f65ab99", "signature_version": "v1", "id": "CVE-2022-48788-85008a99", "signature_type": "Function" }, { "digest": { "length": 439.0, "function_hash": "142090190413430079786128433940551509897" }, "target": { "file": "drivers/nvme/host/rdma.c", "function": "nvme_rdma_error_recovery_work" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d411b2a5da68b8a130c23097014434ac140a2ace", "signature_version": "v1", "id": "CVE-2022-48788-8f29ecae", "signature_type": "Function" }, { "digest": { "length": 482.0, "function_hash": "244910761075627591812400200117594892988" }, "target": { "file": "drivers/nvme/host/rdma.c", "function": "nvme_rdma_error_recovery_work" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b6bb1722f34bbdbabed27acdceaf585d300c5fd2", "signature_version": "v1", "id": "CVE-2022-48788-9374f6d6", "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "125948476036588992742954934907879427317", "109652201163931899279938772266424564153", "145977655902121679879275626162448933837", "56598555705936785387839445251589714898" ] }, "target": { "file": "drivers/nvme/host/rdma.c" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5593f72d1922403c11749532e3a0aa4cf61414e9", "signature_version": "v1", "id": "CVE-2022-48788-9ca526ed", "signature_type": "Line" }, { "digest": { "length": 401.0, "function_hash": "80112456948038699171922982898171515092" }, "target": { "file": "drivers/nvme/host/rdma.c", "function": "nvme_rdma_error_recovery_work" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5593f72d1922403c11749532e3a0aa4cf61414e9", "signature_version": "v1", "id": "CVE-2022-48788-dfd42c7f", "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "125948476036588992742954934907879427317", "109652201163931899279938772266424564153", "145977655902121679879275626162448933837", "56598555705936785387839445251589714898" ] }, "target": { "file": "drivers/nvme/host/rdma.c" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ea86027ac467a055849c4945906f799e7f65ab99", "signature_version": "v1", "id": "CVE-2022-48788-e4a1f6f3", "signature_type": "Line" }, { "digest": { "threshold": 0.9, "line_hashes": [ "125948476036588992742954934907879427317", "109652201163931899279938772266424564153", "145977655902121679879275626162448933837", "56598555705936785387839445251589714898" ] }, "target": { "file": "drivers/nvme/host/rdma.c" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@324f5bdc52ecb6a6dadb31a62823ef8c709d1439", "signature_version": "v1", "id": "CVE-2022-48788-e6868bed", "signature_type": "Line" } ] }