CVE-2022-48921
- Source
- https://cve.org/CVERecord?id=CVE-2022-48921
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-48921.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2022-48921
- Downstream
DEBIAN (1)
RHSA (1)
SUSE (5)
UBUNTU (1)
- Related
- Published
- 2024-08-22T01:32:53Z
- Modified
- 2026-10-20T10:30:52Z
- Summary
- sched/fair: Fix fault in reweight_entity
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
sched/fair: Fix fault in reweight_entity
Syzbot found a GPF in reweight_entity. This has been bisected to commit 4ef0c5c6b5ba ("kernel/sched: Fix sched_fork() access an invalid sched_task_group")
There is a race between sched_post_fork() and setpriority(PRIO_PGRP) within a thread group that causes a null-ptr-deref in reweight_entity() in CFS. The scenario is that the main process spawns number of new threads, which then call setpriority(PRIO_PGRP, 0, -20), wait, and exit. For each of the new threads the copy_process() gets invoked, which adds the new task_struct and calls sched_post_fork() for it.
In the above scenario there is a possibility that setpriority(PRIO_PGRP) and set_one_prio() will be called for a thread in the group that is just being created by copy_process(), and for which the sched_post_fork() has not been executed yet. This will trigger a null pointer dereference in reweight_entity(), as it will try to access the run queue pointer, which hasn't been set.
Before the mentioned change the cfs_rq pointer for the task has been set in sched_fork(), which is called much earlier in copy_process(), before the new task is added to the thread_group. Now it is done in the sched_post_fork(), which is called after that. To fix the issue the remove the update_load param from the update_load param() function and call reweight_task() only if the task flag doesn't have the TASK_NEW flag set.
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48921.json" }- References
-
- https://git.kernel.org/stable/c/13765de8148f71fa795e0a6607de37c49ea5915a
- https://git.kernel.org/stable/c/589a954daab5e18399860b6c8ffaeaf79844eb20
- https://git.kernel.org/stable/c/8f317cd888059c59e2fa924bf4b0957cfa53f78e
- https://git.kernel.org/stable/c/e0bcd6b5779352aed88f2e538a82a39f1a7715bb
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48921.json
- https://nvd.nist.gov/vuln/detail/CVE-2022-48921
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedc85c6fadbef0a3eab41540ea628fa8fe8928c820Fixed8f317cd888059c59e2fa924bf4b0957cfa53f78e
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced3869eecf050416a1d19bac60926f6b5d64b0aa58Fixede0bcd6b5779352aed88f2e538a82a39f1a7715bb
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced4ef0c5c6b5ba1f38f0ea1cedad0cad722f00c14aFixed589a954daab5e18399860b6c8ffaeaf79844eb20Fixed13765de8148f71fa795e0a6607de37c49ea5915a
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced5.10.80Fixed5.10.137
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced5.15.3Fixed5.15.27
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced5.14.19Fixed5.15
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced25d40b828fb855ee62e1039c65a666c9afd60786