CVE-2022-48884

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2022-48884
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-48884.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-48884
Downstream
Related
Published
2024-08-21T06:10:15Z
Modified
2025-10-21T08:15:41.920789Z
Summary
net/mlx5: Fix command stats access after free
Details

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: Fix command stats access after free

Command may fail while driver is reloading and can't accept FW commands till command interface is reinitialized. Such command failure is being logged to command stats. This results in NULL pointer access as command stats structure is being freed and reallocated during mlx5 devlink reload (see kernel log below).

Fix it by making command stats statically allocated on driver probe.

Kernel log: [ 2394.808802] BUG: unable to handle kernel paging request at 000000000002a9c0 [ 2394.810610] PGD 0 P4D 0 [ 2394.811811] Oops: 0002 [#1] SMP NOPTI ... [ 2394.815482] RIP: 0010:nativequeuedspinlockslowpath+0x183/0x1d0 ... [ 2394.829505] Call Trace: [ 2394.830667] rawspinlockirq+0x23/0x26 [ 2394.831858] cmdstatuserr+0x55/0x110 [mlx5core] [ 2394.833020] mlx5accessreg+0xe7/0x150 [mlx5core] [ 2394.834175] mlx5queryportptys+0x78/0xa0 [mlx5core] [ 2394.835337] mlx5eethtoolgetlinkksettings+0x74/0x590 [mlx5core] [ 2394.836454] ? kmemcachealloctrace+0x140/0x1c0 [ 2394.837562] _rhcallgetlinkksettings+0x33/0x100 [ 2394.838663] ? _rtnlunlock+0x25/0x50 [ 2394.839755] _ethtoolgetlinkksettings+0x72/0x150 [ 2394.840862] duplexshow+0x6e/0xc0 [ 2394.841963] devattrshow+0x1c/0x40 [ 2394.843048] sysfskfseqshow+0x9b/0x100 [ 2394.844123] seqread+0x153/0x410 [ 2394.845187] vfsread+0x91/0x140 [ 2394.846226] ksysread+0x4f/0xb0 [ 2394.847234] dosyscall64+0x5b/0x1a0 [ 2394.848228] entrySYSCALL64afterhwframe+0x65/0xca

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
34f46ae0d4b38e83cfb26fb6f06b5b5efea47fdc
Fixed
ddf458641a511e7dff19f3bf0cbbc5dd9fe08ce5
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
34f46ae0d4b38e83cfb26fb6f06b5b5efea47fdc
Fixed
da2e552b469a0cd130ff70a88ccc4139da428a65

Affected versions

v5.*

v5.17
v5.17-rc7
v5.17-rc8
v5.18
v5.18-rc1
v5.18-rc2
v5.18-rc3
v5.18-rc4
v5.18-rc5
v5.18-rc6
v5.18-rc7
v5.19
v5.19-rc1
v5.19-rc2
v5.19-rc3
v5.19-rc4
v5.19-rc5
v5.19-rc6
v5.19-rc7
v5.19-rc8

v6.*

v6.0
v6.0-rc1
v6.0-rc2
v6.0-rc3
v6.0-rc4
v6.0-rc5
v6.0-rc6
v6.0-rc7
v6.1
v6.1-rc1
v6.1-rc2
v6.1-rc3
v6.1-rc4
v6.1-rc5
v6.1-rc6
v6.1-rc7
v6.1-rc8
v6.1.1
v6.1.2
v6.1.3
v6.1.4
v6.1.5
v6.1.6
v6.2-rc1
v6.2-rc2

Database specific

vanir_signatures

[
    {
        "signature_version": "v1",
        "id": "CVE-2022-48884-2fb2fae4",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "283114702810080632226726878331222672236",
                "44317799205296561773113386562726873985",
                "81046766895407370109990471604743081748",
                "217052536965424117299553355762055960209"
            ]
        },
        "target": {
            "file": "include/linux/mlx5/driver.h"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ddf458641a511e7dff19f3bf0cbbc5dd9fe08ce5",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2022-48884-39463c11",
        "signature_type": "Function",
        "digest": {
            "length": 2824.0,
            "function_hash": "29453455731394568730482325570481521336"
        },
        "target": {
            "file": "drivers/net/ethernet/mellanox/mlx5/core/cmd.c",
            "function": "mlx5_cmd_init"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ddf458641a511e7dff19f3bf0cbbc5dd9fe08ce5",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2022-48884-462eac4c",
        "signature_type": "Function",
        "digest": {
            "length": 216.0,
            "function_hash": "205194187666175123725673009555210447641"
        },
        "target": {
            "file": "drivers/net/ethernet/mellanox/mlx5/core/cmd.c",
            "function": "mlx5_cmd_cleanup"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ddf458641a511e7dff19f3bf0cbbc5dd9fe08ce5",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2022-48884-c017c33e",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "282407694362907446425193381444595251972",
                "101129446635814154256323174396557550915",
                "58701011670976759785542177985757268064",
                "297421068832135999495620945406189251633",
                "331090082517632112206055457785707798489",
                "271595332864372055679841565011385577672",
                "25230782477495658835545250921306561103",
                "144713737982097056494168448849537660614",
                "23196416540877562352005361408625616681",
                "62117027360539539877469066331208511671",
                "121167852750840407773976834056254359078",
                "336644742045696633867234494852652670326",
                "320659146166944941923681679762372876665",
                "101631656895998426470018571745497042603",
                "49187711046572779155837996469740225399",
                "206549126409344058420778082084574992306",
                "19199362603469165936268538346962869747",
                "278358987495877606727047453296574400522",
                "60075828405261349250955313477245878636",
                "230342808343577598936645699171341059203"
            ]
        },
        "target": {
            "file": "drivers/net/ethernet/mellanox/mlx5/core/cmd.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ddf458641a511e7dff19f3bf0cbbc5dd9fe08ce5",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2022-48884-c8848838",
        "signature_type": "Function",
        "digest": {
            "length": 216.0,
            "function_hash": "205194187666175123725673009555210447641"
        },
        "target": {
            "file": "drivers/net/ethernet/mellanox/mlx5/core/cmd.c",
            "function": "mlx5_cmd_cleanup"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da2e552b469a0cd130ff70a88ccc4139da428a65",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2022-48884-c9af9ede",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "282407694362907446425193381444595251972",
                "101129446635814154256323174396557550915",
                "58701011670976759785542177985757268064",
                "297421068832135999495620945406189251633",
                "331090082517632112206055457785707798489",
                "271595332864372055679841565011385577672",
                "25230782477495658835545250921306561103",
                "144713737982097056494168448849537660614",
                "23196416540877562352005361408625616681",
                "62117027360539539877469066331208511671",
                "121167852750840407773976834056254359078",
                "336644742045696633867234494852652670326",
                "320659146166944941923681679762372876665",
                "101631656895998426470018571745497042603",
                "49187711046572779155837996469740225399",
                "206549126409344058420778082084574992306",
                "19199362603469165936268538346962869747",
                "278358987495877606727047453296574400522",
                "60075828405261349250955313477245878636",
                "230342808343577598936645699171341059203"
            ]
        },
        "target": {
            "file": "drivers/net/ethernet/mellanox/mlx5/core/cmd.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da2e552b469a0cd130ff70a88ccc4139da428a65",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2022-48884-ebbb7c02",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "283114702810080632226726878331222672236",
                "44317799205296561773113386562726873985",
                "81046766895407370109990471604743081748",
                "217052536965424117299553355762055960209"
            ]
        },
        "target": {
            "file": "include/linux/mlx5/driver.h"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da2e552b469a0cd130ff70a88ccc4139da428a65",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2022-48884-f89974c7",
        "signature_type": "Function",
        "digest": {
            "length": 2824.0,
            "function_hash": "29453455731394568730482325570481521336"
        },
        "target": {
            "file": "drivers/net/ethernet/mellanox/mlx5/core/cmd.c",
            "function": "mlx5_cmd_init"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da2e552b469a0cd130ff70a88ccc4139da428a65",
        "deprecated": false
    }
]

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.18.0
Fixed
6.1.7