In the Linux kernel, the following vulnerability has been resolved:
nvme-rdma: fix possible use-after-free in transport error_recovery work
While nvmerdmasubmitasynceventwork is checking the ctrl and queue state before preparing the AER command and scheduling iowork, in order to fully prevent a race where this check is not reliable the error recovery work must flush asynceventwork before continuing to destroy the admin queue after setting the ctrl state to RESETTING such that there is no race .submitasyncevent and the error recovery handler itself changing the ctrl state.
[
{
"id": "CVE-2022-48788-087c4ce2",
"signature_version": "v1",
"digest": {
"length": 490.0,
"function_hash": "323964871477412315924185841566452498639"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@324f5bdc52ecb6a6dadb31a62823ef8c709d1439",
"target": {
"file": "drivers/nvme/host/rdma.c",
"function": "nvme_rdma_error_recovery_work"
}
},
{
"id": "CVE-2022-48788-397e21a0",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"125948476036588992742954934907879427317",
"109652201163931899279938772266424564153",
"145977655902121679879275626162448933837",
"56598555705936785387839445251589714898"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@646952b2210f19e584d2bf9eb5d092abdca2fcc1",
"target": {
"file": "drivers/nvme/host/rdma.c"
}
},
{
"id": "CVE-2022-48788-4038efda",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"125948476036588992742954934907879427317",
"109652201163931899279938772266424564153",
"145977655902121679879275626162448933837",
"56598555705936785387839445251589714898"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b6bb1722f34bbdbabed27acdceaf585d300c5fd2",
"target": {
"file": "drivers/nvme/host/rdma.c"
}
},
{
"id": "CVE-2022-48788-61adfdd8",
"signature_version": "v1",
"digest": {
"length": 490.0,
"function_hash": "323964871477412315924185841566452498639"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@646952b2210f19e584d2bf9eb5d092abdca2fcc1",
"target": {
"file": "drivers/nvme/host/rdma.c",
"function": "nvme_rdma_error_recovery_work"
}
},
{
"id": "CVE-2022-48788-61e8ce90",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"125948476036588992742954934907879427317",
"109652201163931899279938772266424564153",
"145977655902121679879275626162448933837",
"56598555705936785387839445251589714898"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d411b2a5da68b8a130c23097014434ac140a2ace",
"target": {
"file": "drivers/nvme/host/rdma.c"
}
},
{
"id": "CVE-2022-48788-85008a99",
"signature_version": "v1",
"digest": {
"length": 482.0,
"function_hash": "244910761075627591812400200117594892988"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ea86027ac467a055849c4945906f799e7f65ab99",
"target": {
"file": "drivers/nvme/host/rdma.c",
"function": "nvme_rdma_error_recovery_work"
}
},
{
"id": "CVE-2022-48788-8f29ecae",
"signature_version": "v1",
"digest": {
"length": 439.0,
"function_hash": "142090190413430079786128433940551509897"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d411b2a5da68b8a130c23097014434ac140a2ace",
"target": {
"file": "drivers/nvme/host/rdma.c",
"function": "nvme_rdma_error_recovery_work"
}
},
{
"id": "CVE-2022-48788-9374f6d6",
"signature_version": "v1",
"digest": {
"length": 482.0,
"function_hash": "244910761075627591812400200117594892988"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b6bb1722f34bbdbabed27acdceaf585d300c5fd2",
"target": {
"file": "drivers/nvme/host/rdma.c",
"function": "nvme_rdma_error_recovery_work"
}
},
{
"id": "CVE-2022-48788-9ca526ed",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"125948476036588992742954934907879427317",
"109652201163931899279938772266424564153",
"145977655902121679879275626162448933837",
"56598555705936785387839445251589714898"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5593f72d1922403c11749532e3a0aa4cf61414e9",
"target": {
"file": "drivers/nvme/host/rdma.c"
}
},
{
"id": "CVE-2022-48788-dfd42c7f",
"signature_version": "v1",
"digest": {
"length": 401.0,
"function_hash": "80112456948038699171922982898171515092"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5593f72d1922403c11749532e3a0aa4cf61414e9",
"target": {
"file": "drivers/nvme/host/rdma.c",
"function": "nvme_rdma_error_recovery_work"
}
},
{
"id": "CVE-2022-48788-e4a1f6f3",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"125948476036588992742954934907879427317",
"109652201163931899279938772266424564153",
"145977655902121679879275626162448933837",
"56598555705936785387839445251589714898"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ea86027ac467a055849c4945906f799e7f65ab99",
"target": {
"file": "drivers/nvme/host/rdma.c"
}
},
{
"id": "CVE-2022-48788-e6868bed",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"125948476036588992742954934907879427317",
"109652201163931899279938772266424564153",
"145977655902121679879275626162448933837",
"56598555705936785387839445251589714898"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@324f5bdc52ecb6a6dadb31a62823ef8c709d1439",
"target": {
"file": "drivers/nvme/host/rdma.c"
}
}
]