In the Linux kernel, the following vulnerability has been resolved:
scsi: target: tcmu: Fix possible page UAF
tcmutrygetdatapage() looks up pages under cmdrlock, but it does not take refcount properly and just returns page pointer. When tcmutrygetdatapage() returns, the returned page may have been freed by tcmublocks_release().
We need to getpage() under cmdrlock to avoid concurrent tcmublocksrelease().
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a9564d84ed9f6ee71017d062d0d2182154294a4b",
"target": {
"function": "tcmu_vma_fault",
"file": "drivers/target/target_core_user.c"
},
"deprecated": false,
"id": "CVE-2022-49053-05d6e578",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 616.0,
"function_hash": "109748332314687916438671565355319949559"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a6968f7a367f128d120447360734344d5a3d5336",
"target": {
"function": "tcmu_vma_fault",
"file": "drivers/target/target_core_user.c"
},
"deprecated": false,
"id": "CVE-2022-49053-1cf45191",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 616.0,
"function_hash": "109748332314687916438671565355319949559"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fb7a5115422fbd6a4d505e8844f1ef5529f10489",
"target": {
"function": "tcmu_try_get_block_page",
"file": "drivers/target/target_core_user.c"
},
"deprecated": false,
"id": "CVE-2022-49053-22336ee7",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 384.0,
"function_hash": "334475330983966756191540598547300930380"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e3e0e067d5b34e4a68e3cc55f8eebc413f56f8ed",
"target": {
"file": "drivers/target/target_core_user.c"
},
"deprecated": false,
"id": "CVE-2022-49053-29fa6bc5",
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"190895031556893358518496131416454587948",
"322986966089363117637941602014246043162",
"214318767756267377923408931365094627643",
"326839945520755390942120869516469802616",
"310425471890160790305236264965602592056",
"107435720930354071503839975449466592572",
"109222161545983608549308070767432468056",
"129485047624242873753607541836793671909",
"114084972579977914228453268144502284628",
"71446799361303327425541354224437045794",
"38069712523551822479207272453576938434",
"335947811649975223046475103892934070528"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e3e0e067d5b34e4a68e3cc55f8eebc413f56f8ed",
"target": {
"function": "tcmu_try_get_block_page",
"file": "drivers/target/target_core_user.c"
},
"deprecated": false,
"id": "CVE-2022-49053-34380ebe",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 384.0,
"function_hash": "334475330983966756191540598547300930380"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d7c5d79e50be6e06b669141e3db1f977a0dd4e8e",
"target": {
"function": "tcmu_try_get_block_page",
"file": "drivers/target/target_core_user.c"
},
"deprecated": false,
"id": "CVE-2022-49053-60babac7",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 891.0,
"function_hash": "62524965464561842341141929001076635230"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b7f3b5d70c834f49f7d87a2f2ed1c6284d9a0322",
"target": {
"file": "drivers/target/target_core_user.c"
},
"deprecated": false,
"id": "CVE-2022-49053-697e0b2e",
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"229267820023314631686533121676432877434",
"302718823649869410651281428846614155994",
"254125698140187367987322929545194021011",
"326839945520755390942120869516469802616",
"310425471890160790305236264965602592056",
"107435720930354071503839975449466592572",
"307528868952482891215758340992813926859",
"222139514692343743418597358544671780751",
"114084972579977914228453268144502284628",
"71446799361303327425541354224437045794",
"38069712523551822479207272453576938434",
"335947811649975223046475103892934070528"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d7c5d79e50be6e06b669141e3db1f977a0dd4e8e",
"target": {
"file": "drivers/target/target_core_user.c"
},
"deprecated": false,
"id": "CVE-2022-49053-6a0b567a",
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"259364716408625446990343411536609709608",
"322986966089363117637941602014246043162",
"214318767756267377923408931365094627643",
"326839945520755390942120869516469802616",
"310425471890160790305236264965602592056",
"107435720930354071503839975449466592572",
"109222161545983608549308070767432468056",
"129485047624242873753607541836793671909",
"178644161511338088861279969370019565573",
"97491892036102475628532055235945688668",
"38069712523551822479207272453576938434",
"335947811649975223046475103892934070528"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d7c5d79e50be6e06b669141e3db1f977a0dd4e8e",
"target": {
"function": "tcmu_vma_fault",
"file": "drivers/target/target_core_user.c"
},
"deprecated": false,
"id": "CVE-2022-49053-6adaac85",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 622.0,
"function_hash": "274548616763890085645870184891398784769"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e3e0e067d5b34e4a68e3cc55f8eebc413f56f8ed",
"target": {
"function": "tcmu_vma_fault",
"file": "drivers/target/target_core_user.c"
},
"deprecated": false,
"id": "CVE-2022-49053-8b4adc20",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 622.0,
"function_hash": "174987948351339597816019730354682848812"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aec36b98a1bbaa84bfd8299a306e4c12314af626",
"target": {
"file": "drivers/target/target_core_user.c"
},
"deprecated": false,
"id": "CVE-2022-49053-9298a1f0",
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"190895031556893358518496131416454587948",
"322986966089363117637941602014246043162",
"214318767756267377923408931365094627643",
"326839945520755390942120869516469802616",
"310425471890160790305236264965602592056",
"107435720930354071503839975449466592572",
"109222161545983608549308070767432468056",
"129485047624242873753607541836793671909",
"114084972579977914228453268144502284628",
"71446799361303327425541354224437045794",
"38069712523551822479207272453576938434",
"335947811649975223046475103892934070528"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b7f3b5d70c834f49f7d87a2f2ed1c6284d9a0322",
"target": {
"function": "tcmu_vma_fault",
"file": "drivers/target/target_core_user.c"
},
"deprecated": false,
"id": "CVE-2022-49053-9d07cf4f",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 616.0,
"function_hash": "109748332314687916438671565355319949559"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a6968f7a367f128d120447360734344d5a3d5336",
"target": {
"function": "tcmu_try_get_data_page",
"file": "drivers/target/target_core_user.c"
},
"deprecated": false,
"id": "CVE-2022-49053-b0330e2c",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 386.0,
"function_hash": "262321729832147330342961451265227922777"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fb7a5115422fbd6a4d505e8844f1ef5529f10489",
"target": {
"function": "tcmu_vma_fault",
"file": "drivers/target/target_core_user.c"
},
"deprecated": false,
"id": "CVE-2022-49053-db9fe0c2",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 622.0,
"function_hash": "174987948351339597816019730354682848812"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a9564d84ed9f6ee71017d062d0d2182154294a4b",
"target": {
"function": "tcmu_try_get_data_page",
"file": "drivers/target/target_core_user.c"
},
"deprecated": false,
"id": "CVE-2022-49053-dfe9a6ad",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 386.0,
"function_hash": "262321729832147330342961451265227922777"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fb7a5115422fbd6a4d505e8844f1ef5529f10489",
"target": {
"file": "drivers/target/target_core_user.c"
},
"deprecated": false,
"id": "CVE-2022-49053-e0df13b3",
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"190895031556893358518496131416454587948",
"322986966089363117637941602014246043162",
"214318767756267377923408931365094627643",
"326839945520755390942120869516469802616",
"310425471890160790305236264965602592056",
"107435720930354071503839975449466592572",
"109222161545983608549308070767432468056",
"129485047624242873753607541836793671909",
"114084972579977914228453268144502284628",
"71446799361303327425541354224437045794",
"38069712523551822479207272453576938434",
"335947811649975223046475103892934070528"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aec36b98a1bbaa84bfd8299a306e4c12314af626",
"target": {
"function": "tcmu_try_get_block_page",
"file": "drivers/target/target_core_user.c"
},
"deprecated": false,
"id": "CVE-2022-49053-e54e3654",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 384.0,
"function_hash": "334475330983966756191540598547300930380"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a9564d84ed9f6ee71017d062d0d2182154294a4b",
"target": {
"file": "drivers/target/target_core_user.c"
},
"deprecated": false,
"id": "CVE-2022-49053-eb38d331",
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"229267820023314631686533121676432877434",
"302718823649869410651281428846614155994",
"254125698140187367987322929545194021011",
"326839945520755390942120869516469802616",
"310425471890160790305236264965602592056",
"107435720930354071503839975449466592572",
"307528868952482891215758340992813926859",
"222139514692343743418597358544671780751",
"114084972579977914228453268144502284628",
"71446799361303327425541354224437045794",
"38069712523551822479207272453576938434",
"335947811649975223046475103892934070528"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b7f3b5d70c834f49f7d87a2f2ed1c6284d9a0322",
"target": {
"function": "tcmu_try_get_data_page",
"file": "drivers/target/target_core_user.c"
},
"deprecated": false,
"id": "CVE-2022-49053-f1f5b746",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 386.0,
"function_hash": "262321729832147330342961451265227922777"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aec36b98a1bbaa84bfd8299a306e4c12314af626",
"target": {
"function": "tcmu_vma_fault",
"file": "drivers/target/target_core_user.c"
},
"deprecated": false,
"id": "CVE-2022-49053-f88edb8c",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 622.0,
"function_hash": "174987948351339597816019730354682848812"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a6968f7a367f128d120447360734344d5a3d5336",
"target": {
"file": "drivers/target/target_core_user.c"
},
"deprecated": false,
"id": "CVE-2022-49053-ffb95f36",
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"229267820023314631686533121676432877434",
"302718823649869410651281428846614155994",
"254125698140187367987322929545194021011",
"326839945520755390942120869516469802616",
"310425471890160790305236264965602592056",
"107435720930354071503839975449466592572",
"307528868952482891215758340992813926859",
"222139514692343743418597358544671780751",
"114084972579977914228453268144502284628",
"71446799361303327425541354224437045794",
"38069712523551822479207272453576938434",
"335947811649975223046475103892934070528"
]
}
}
]