In the Linux kernel, the following vulnerability has been resolved:
RDMA/hfi1: Fix use-after-free bug for mm struct
Under certain conditions, such as MPIAbort, the hfi1 cleanup code may represent the last reference held on the task mm. hfi1mmurbunregister() then drops the last reference and the mm is freed before the final use in hfi1releaseuserpages(). A new task may allocate the mm structure while it is still being used, resulting in problems. One manifestation is corruption of the mmapsem counter leading to a hang in down_write(). Another is corruption of an mm struct that is in use by another task.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0b7186d657ee55e2cdefae498f07d5c1961e8023",
"target": {
"function": "hfi1_mmu_rb_unregister",
"file": "drivers/infiniband/hw/hfi1/mmu_rb.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49076-0d5f3bf0",
"digest": {
"function_hash": "305213421210655976262567312953780526792",
"length": 491.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5a9a1b24ddb510715f8f621263938186579a965c",
"target": {
"function": "hfi1_mmu_rb_unregister",
"file": "drivers/infiniband/hw/hfi1/mmu_rb.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49076-105edcc8",
"digest": {
"function_hash": "305213421210655976262567312953780526792",
"length": 491.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9ca11bd8222a612de0d2f54d050bfcf61ae2883f",
"target": {
"file": "drivers/infiniband/hw/hfi1/mmu_rb.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49076-52a99c4f",
"digest": {
"line_hashes": [
"60421278133153666479272483562052883853",
"75918215399118434036665480941975260730",
"144095375345532202614177039314555276092",
"112736317603855402633397241555498255558",
"9461068456427734329379595482062290186",
"326584259611517192356221349581466012084"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0b7186d657ee55e2cdefae498f07d5c1961e8023",
"target": {
"file": "drivers/infiniband/hw/hfi1/mmu_rb.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49076-833c53d9",
"digest": {
"line_hashes": [
"60421278133153666479272483562052883853",
"75918215399118434036665480941975260730",
"144095375345532202614177039314555276092",
"112736317603855402633397241555498255558",
"9461068456427734329379595482062290186",
"326584259611517192356221349581466012084"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2bbac98d0930e8161b1957dc0ec99de39ade1b3c",
"target": {
"file": "drivers/infiniband/hw/hfi1/mmu_rb.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49076-8c76525d",
"digest": {
"line_hashes": [
"60421278133153666479272483562052883853",
"75918215399118434036665480941975260730",
"144095375345532202614177039314555276092",
"112736317603855402633397241555498255558",
"9461068456427734329379595482062290186",
"326584259611517192356221349581466012084"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2bbac98d0930e8161b1957dc0ec99de39ade1b3c",
"target": {
"function": "hfi1_mmu_rb_unregister",
"file": "drivers/infiniband/hw/hfi1/mmu_rb.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49076-92285c6d",
"digest": {
"function_hash": "305213421210655976262567312953780526792",
"length": 491.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5a9a1b24ddb510715f8f621263938186579a965c",
"target": {
"file": "drivers/infiniband/hw/hfi1/mmu_rb.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49076-b0c43150",
"digest": {
"line_hashes": [
"60421278133153666479272483562052883853",
"75918215399118434036665480941975260730",
"144095375345532202614177039314555276092",
"112736317603855402633397241555498255558",
"9461068456427734329379595482062290186",
"326584259611517192356221349581466012084"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5f54364ff6cfcd14cddf5441c4a490bb28dd69f7",
"target": {
"function": "hfi1_mmu_rb_unregister",
"file": "drivers/infiniband/hw/hfi1/mmu_rb.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49076-ce7cbd8a",
"digest": {
"function_hash": "305213421210655976262567312953780526792",
"length": 491.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9ca11bd8222a612de0d2f54d050bfcf61ae2883f",
"target": {
"function": "hfi1_mmu_rb_unregister",
"file": "drivers/infiniband/hw/hfi1/mmu_rb.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49076-eb17e64b",
"digest": {
"function_hash": "305213421210655976262567312953780526792",
"length": 491.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5f54364ff6cfcd14cddf5441c4a490bb28dd69f7",
"target": {
"file": "drivers/infiniband/hw/hfi1/mmu_rb.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49076-ee223f5d",
"digest": {
"line_hashes": [
"60421278133153666479272483562052883853",
"75918215399118434036665480941975260730",
"144095375345532202614177039314555276092",
"112736317603855402633397241555498255558",
"9461068456427734329379595482062290186",
"326584259611517192356221349581466012084"
],
"threshold": 0.9
}
}
]