CVE-2022-48791

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-48791
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-48791.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-48791
Downstream
CLSA (6)
DEBIAN (1)
SUSE (17)
UBUNTU (1)
Related
SUSE (17)
Published
2024-07-16T11:43:47Z
Modified
2026-10-08T02:49:22Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
scsi: pm8001: Fix use-after-free for aborted TMF sas_task
Details

In the Linux kernel, the following vulnerability has been resolved:

scsi: pm8001: Fix use-after-free for aborted TMF sas_task

Currently a use-after-free may occur if a TMF sas_task is aborted before we handle the IO completion in mpi_ssp_completion(). The abort occurs due to timeout.

When the timeout occurs, the SAS_TASK_STATE_ABORTED flag is set and the sas_task is freed in pm8001_exec_internal_tmf_task().

However, if the I/O completion occurs later, the I/O completion still thinks that the sas_task is available. Fix this by clearing the ccb->task if the TMF times out - the I/O completion handler does nothing if this pointer is cleared.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48791.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
968ee9176a4489ce6d5ee54ff88dadfbff9b95f4
Fixed
d872e7b5fe38f325f5206b6872746fa02c2b4819
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
d712d3fb484b7fa8d1d57e9ca6f134bb9d8c18b1
Fixed
3c334cdfd94945b8edb94022a0371a8665b17366
Fixed
510b21442c3a2e3ecc071ba3e666b320e7acdd61
Fixed
61f162aa4381845acbdc7f2be4dfb694d027c018
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
5.10.61
Fixed
5.10.102
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
5.13.13
Fixed
5.14
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
fa3c19ceaa8b4b7c29d710c2c407df57d256a6c5

Affected versions

v5.*
v5.10.100
v5.10.101
v5.10.61
v5.10.62
v5.10.63
v5.10.64
v5.10.65
v5.10.66
v5.10.67
v5.10.68
v5.10.69
v5.10.70
v5.10.71
v5.10.72
v5.10.73
v5.10.74
v5.10.75
v5.10.76
v5.10.77
v5.10.78
v5.10.79
v5.10.80
v5.10.81
v5.10.82
v5.10.83
v5.10.84
v5.10.85
v5.10.86
v5.10.87
v5.10.88
v5.10.89
v5.10.90
v5.10.91
v5.10.92
v5.10.93
v5.10.94
v5.10.95
v5.10.96
v5.10.97
v5.10.98
v5.10.99
v5.13.13
v5.13.14
v5.13.15
v5.13.16
v5.13.17
v5.13.18
v5.13.19

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-48791.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
5.10.102
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.25
Type
ECOSYSTEM
Events
Introduced
5.14.0
Fixed
5.16.11

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-48791.json"