CVE-2022-48937
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2022-48937
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-48937.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2022-48937
- Downstream
- Related
- Published
- 2024-08-22T03:31:32Z
- Modified
- 2025-10-21T08:49:24.312603Z
- Summary
- io_uring: add a schedule point in io_add_buffers()
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
iouring: add a schedule point in ioadd_buffers()
Looping ~65535 times doing kmalloc() calls can trigger soft lockups, especially with DEBUG features (like KASAN).
[ 253.536212] watchdog: BUG: soft lockup - CPU#64 stuck for 26s! [b219417889:12575] [ 253.544433] Modules linked in: vfat fat i2cmuxpca954x i2cmux spidev cdcacm xhcipci xhcihcd sha3generic gq(O) [ 253.544451] CPU: 64 PID: 12575 Comm: b219417889 Tainted: G S O 5.17.0-smp-DEV #801 [ 253.544457] RIP: 0010:kerneltextaddress (./include/asm-generic/sections.h:192 ./include/linux/kallsyms.h:29 kernel/extable.c:67 kernel/extable.c:98) [ 253.544464] Code: 0f 93 c0 48 c7 c1 e0 63 d7 a4 48 39 cb 0f 92 c1 20 c1 0f b6 c1 5b 5d c3 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 53 48 89 fb <48> c7 c0 00 00 80 a0 41 be 01 00 00 00 48 39 c7 72 0c 48 c7 c0 40 [ 253.544468] RSP: 0018:ffff8882d8baf4c0 EFLAGS: 00000246 [ 253.544471] RAX: 1ffff1105b175e00 RBX: ffffffffa13ef09a RCX: 00000000a13ef001 [ 253.544474] RDX: ffffffffa13ef09a RSI: ffff8882d8baf558 RDI: ffffffffa13ef09a [ 253.544476] RBP: ffff8882d8baf4d8 R08: ffff8882d8baf5e0 R09: 0000000000000004 [ 253.544479] R10: ffff8882d8baf5e8 R11: ffffffffa0d59a50 R12: ffff8882eab20380 [ 253.544481] R13: ffffffffa0d59a50 R14: dffffc0000000000 R15: 1ffff1105b175eb0 [ 253.544483] FS: 00000000016d3380(0000) GS:ffff88af48c00000(0000) knlGS:0000000000000000 [ 253.544486] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 253.544488] CR2: 00000000004af0f0 CR3: 00000002eabfa004 CR4: 00000000003706e0 [ 253.544491] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 253.544492] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 253.544494] Call Trace: [ 253.544496] <TASK> [ 253.544498] ? ioqueuesqe (fs/iouring.c:7143) [ 253.544505] kerneltextaddress (kernel/extable.c:78) [ 253.544508] unwindgetreturnaddress (arch/x86/kernel/unwindframe.c:19) [ 253.544514] archstackwalk (arch/x86/kernel/stacktrace.c:27) [ 253.544517] ? ioqueuesqe (fs/iouring.c:7143) [ 253.544521] stacktracesave (kernel/stacktrace.c:123) [ 253.544527] _kasankmalloc (mm/kasan/common.c:39 mm/kasan/common.c:45 mm/kasan/common.c:436 mm/kasan/common.c:515) [ 253.544531] ? __kasankmalloc (mm/kasan/common.c:39 mm/kasan/common.c:45 mm/kasan/common.c:436 mm/kasan/common.c:515) [ 253.544533] ? _kasankmalloc (mm/kasan/common.c:524) [ 253.544535] ? kmemcachealloctrace (./include/linux/kasan.h:270 mm/slab.c:3567) [ 253.544541] ? ioissuesqe (fs/iouring.c:4556 fs/iouring.c:4589 fs/iouring.c:6828) [ 253.544544] ? _ioqueuesqe (fs/iouring.c:?) [ 253.544551] _kasankmalloc (mm/kasan/common.c:524) [ 253.544553] kmemcachealloctrace (./include/linux/kasan.h:270 mm/slab.c:3567) [ 253.544556] ? ioissuesqe (fs/iouring.c:4556 fs/iouring.c:4589 fs/iouring.c:6828) [ 253.544560] ioissuesqe (fs/iouring.c:4556 fs/iouring.c:4589 fs/iouring.c:6828) [ 253.544564] ? _kasanslaballoc (mm/kasan/common.c:45 mm/kasan/common.c:436 mm/kasan/common.c:469) [ 253.544567] ? _kasanslaballoc (mm/kasan/common.c:39 mm/kasan/common.c:45 mm/kasan/common.c:436 mm/kasan/common.c:469) [ 253.544569] ? kmemcacheallocbulk (mm/slab.h:732 mm/slab.c:3546) [ 253.544573] ? _ioallocreqrefill (fs/iouring.c:2078) [ 253.544578] ? iosubmitsqes (fs/iouring.c:7441) [ 253.544581] ? _sesysiouringenter (fs/iouring.c:10154 fs/iouring.c:10096) [ 253.544584] ? _x64sysiouringenter (fs/iouring.c:10096) [ 253.544587] ? dosyscall64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80) [ 253.544590] ? entrySYSCALL64afterhwframe (??:?) [ 253.544596] _ioqueuesqe (fs/iouring.c:?) [ 253.544600] ioqueuesqe (fs/iouring.c:7143) [ 253.544603] iosubmitsqe (fs/iouring.c:?) [ 253.544608] iosubmitsqes (fs/iouring.c:?) [ 253.544612] _sesysiouringenter (fs/iouring.c:10154 fs/io_uri ---truncated---
- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/4a93c6594613c3429b6f30136fff115c7f803af4
- https://git.kernel.org/stable/c/8f3cc3c5bc43d03b5748ac4fb8d180084952c36a
- https://git.kernel.org/stable/c/c718ea4e7382e18957ed0e88a5f855e2122d9c00
- https://git.kernel.org/stable/c/f240762f88b4b1b58561939ffd44837759756477
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedddf0322db79c5984dc1a1db890f946dd19b7d6d9Fixed4a93c6594613c3429b6f30136fff115c7f803af4
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedddf0322db79c5984dc1a1db890f946dd19b7d6d9Fixedc718ea4e7382e18957ed0e88a5f855e2122d9c00
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedddf0322db79c5984dc1a1db890f946dd19b7d6d9Fixed8f3cc3c5bc43d03b5748ac4fb8d180084952c36a
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedddf0322db79c5984dc1a1db890f946dd19b7d6d9Fixedf240762f88b4b1b58561939ffd44837759756477
Affected versions
v5.*
Database specific
vanir_signatures
[
{
"id": "CVE-2022-48937-4556729c",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"91414922481144785508058024071946224600",
"43850529659078421102375708707890976706",
"119499308934452224175524020346763596347",
"30046551102071320695937368941536424407"
],
"threshold": 0.9
},
"target": {
"file": "fs/io_uring.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c718ea4e7382e18957ed0e88a5f855e2122d9c00",
"signature_type": "Line"
},
{
"id": "CVE-2022-48937-463d0961",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"91414922481144785508058024071946224600",
"43850529659078421102375708707890976706",
"119499308934452224175524020346763596347",
"30046551102071320695937368941536424407"
],
"threshold": 0.9
},
"target": {
"file": "fs/io_uring.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f240762f88b4b1b58561939ffd44837759756477",
"signature_type": "Line"
},
{
"id": "CVE-2022-48937-4692b27e",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"91414922481144785508058024071946224600",
"43850529659078421102375708707890976706",
"119499308934452224175524020346763596347",
"30046551102071320695937368941536424407"
],
"threshold": 0.9
},
"target": {
"file": "fs/io_uring.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4a93c6594613c3429b6f30136fff115c7f803af4",
"signature_type": "Line"
},
{
"id": "CVE-2022-48937-56baeee4",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 558.0,
"function_hash": "1685294118113995025108158744621044187"
},
"target": {
"function": "io_add_buffers",
"file": "fs/io_uring.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c718ea4e7382e18957ed0e88a5f855e2122d9c00",
"signature_type": "Function"
},
{
"id": "CVE-2022-48937-a7459eea",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"91414922481144785508058024071946224600",
"43850529659078421102375708707890976706",
"119499308934452224175524020346763596347",
"30046551102071320695937368941536424407"
],
"threshold": 0.9
},
"target": {
"file": "fs/io_uring.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8f3cc3c5bc43d03b5748ac4fb8d180084952c36a",
"signature_type": "Line"
},
{
"id": "CVE-2022-48937-aaac3479",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 558.0,
"function_hash": "1685294118113995025108158744621044187"
},
"target": {
"function": "io_add_buffers",
"file": "fs/io_uring.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4a93c6594613c3429b6f30136fff115c7f803af4",
"signature_type": "Function"
},
{
"id": "CVE-2022-48937-b0fa470a",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 558.0,
"function_hash": "1685294118113995025108158744621044187"
},
"target": {
"function": "io_add_buffers",
"file": "fs/io_uring.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8f3cc3c5bc43d03b5748ac4fb8d180084952c36a",
"signature_type": "Function"
},
{
"id": "CVE-2022-48937-ee87d6d4",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 558.0,
"function_hash": "1685294118113995025108158744621044187"
},
"target": {
"function": "io_add_buffers",
"file": "fs/io_uring.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f240762f88b4b1b58561939ffd44837759756477",
"signature_type": "Function"
}
]