In the Linux kernel, the following vulnerability has been resolved:
SUNRPC: lock against ->sock changing during sysfs read
->sock can be set to NULL asynchronously unless ->recv_mutex is held. So it is important to hold that mutex. Otherwise a sysfs read can trigger an oops. Commit 17f09d3f619a ("SUNRPC: Check if the xprt is connected before handling sysfs reads") appears to attempt to fix this problem, but it only narrows the race window.
{ "vanir_signatures": [ { "signature_version": "v1", "signature_type": "Function", "target": { "file": "net/sunrpc/xprtsock.c", "function": "get_srcport" }, "deprecated": false, "digest": { "length": 158.0, "function_hash": "192744032566394403190735328165724811267" }, "id": "CVE-2022-48816-0a4c45b5", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b49ea673e119f59c71645e2f65b3ccad857c90ee" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "net/sunrpc/sysfs.c" }, "deprecated": false, "digest": { "line_hashes": [ "109830019229992966519650686341364012798", "9399690598898623578727570421710829394", "266999274637241550568877436265751242626", "339185436705305328733965299902525716898", "91848829479257926725718012960573611020", "169541577034020244013608490394550657993", "227886950088149272471476377842352009727" ], "threshold": 0.9 }, "id": "CVE-2022-48816-23b29eb1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9482ab4540f5bcc869b44c067ae99b5fca16bd07" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "net/sunrpc/sysfs.c", "function": "rpc_sysfs_xprt_srcaddr_show" }, "deprecated": false, "digest": { "length": 430.0, "function_hash": "113976281683419720247684523204663167400" }, "id": "CVE-2022-48816-35a5cfc0", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9482ab4540f5bcc869b44c067ae99b5fca16bd07" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "net/sunrpc/sysfs.c" }, "deprecated": false, "digest": { "line_hashes": [ "109830019229992966519650686341364012798", "9399690598898623578727570421710829394", "266999274637241550568877436265751242626", "339185436705305328733965299902525716898", "91848829479257926725718012960573611020", "169541577034020244013608490394550657993", "227886950088149272471476377842352009727" ], "threshold": 0.9 }, "id": "CVE-2022-48816-6a27304a", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b49ea673e119f59c71645e2f65b3ccad857c90ee" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "net/sunrpc/xprtsock.c" }, "deprecated": false, "digest": { "line_hashes": [ "7432918295869832144341494318466157868", "225598431994745385713905287949358626093", "328488924176720032945355860438994264638", "271867236959658547087781873583436652893" ], "threshold": 0.9 }, "id": "CVE-2022-48816-7d1ec107", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b49ea673e119f59c71645e2f65b3ccad857c90ee" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "net/sunrpc/xprtsock.c" }, "deprecated": false, "digest": { "line_hashes": [ "7432918295869832144341494318466157868", "225598431994745385713905287949358626093", "328488924176720032945355860438994264638", "271867236959658547087781873583436652893" ], "threshold": 0.9 }, "id": "CVE-2022-48816-b18e69d0", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9482ab4540f5bcc869b44c067ae99b5fca16bd07" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "net/sunrpc/xprtsock.c", "function": "get_srcport" }, "deprecated": false, "digest": { "length": 158.0, "function_hash": "192744032566394403190735328165724811267" }, "id": "CVE-2022-48816-d5dffa45", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9482ab4540f5bcc869b44c067ae99b5fca16bd07" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "net/sunrpc/sysfs.c", "function": "rpc_sysfs_xprt_srcaddr_show" }, "deprecated": false, "digest": { "length": 430.0, "function_hash": "113976281683419720247684523204663167400" }, "id": "CVE-2022-48816-fffc9e27", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b49ea673e119f59c71645e2f65b3ccad857c90ee" } ] }