In the Linux kernel, the following vulnerability has been resolved:
dm thin: fix use-after-free crash in dmsmregisterthresholdcallback
Fault inject on pool metadata device reports: BUG: KASAN: use-after-free in dmpoolregistermetadatathreshold+0x40/0x80 Read of size 8 at addr ffff8881b9d50068 by task dmsetup/950
CPU: 7 PID: 950 Comm: dmsetup Tainted: G W 5.19.0-rc6 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014 Call Trace: <TASK> dumpstacklvl+0x34/0x44 printaddressdescription.constprop.0.cold+0xeb/0x3f4 kasanreport.cold+0xe6/0x147 dmpoolregistermetadatathreshold+0x40/0x80 poolctr+0xa0a/0x1150 dmtableaddtarget+0x2c8/0x640 tableload+0x1fd/0x430 ctlioctl+0x2c4/0x5a0 dmctlioctl+0xa/0x10 _x64sysioctl+0xb3/0xd0 dosyscall64+0x35/0x80 entrySYSCALL64afterhwframe+0x46/0xb0
This can be easily reproduced using: echo offline > /sys/block/sda/device/state dd if=/dev/zero of=/dev/mapper/thin bs=4k count=10 dmsetup load pool --table "0 20971520 thin-pool /dev/sda /dev/sdb 128 0 0"
If a metadata commit fails, the transaction will be aborted and the metadata space maps will be destroyed. If a DM table reload then happens for this failed thin-pool, a use-after-free will occur in dmsmregisterthresholdcallback (called from dmpoolregistermetadatathreshold).
Fix this by in dmpoolregistermetadatathreshold() by returning the -EINVAL error if the thin-pool is in fail mode. Also fail pool_ctr() with a new error message: "Error registering metadata threshold".
[
{
"id": "CVE-2022-50092-035c907b",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f83131a3071a0b61a4d7dca70f95adb3ffad920e",
"signature_type": "Function",
"digest": {
"function_hash": "59074473449400742917679790223617021667",
"length": 213.0
},
"deprecated": false,
"target": {
"file": "drivers/md/dm-thin-metadata.c",
"function": "dm_pool_register_metadata_threshold"
}
},
{
"id": "CVE-2022-50092-0bc01f00",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1a199fa9217d28511ff88529238fd9980ea64cf3",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"16529511490967792599669371931843741040",
"297114256853781335659224176034712310776",
"113720803604668716485215466463148646942",
"4855201950401957708749467998283793346",
"308852000970892712432794245964722370818",
"129335565632235321763874397543097556867"
]
},
"deprecated": false,
"target": {
"file": "drivers/md/dm-thin-metadata.c"
}
},
{
"id": "CVE-2022-50092-223b73d3",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3534e5a5ed2997ca1b00f44a0378a075bd05e8a3",
"signature_type": "Function",
"digest": {
"function_hash": "59074473449400742917679790223617021667",
"length": 213.0
},
"deprecated": false,
"target": {
"file": "drivers/md/dm-thin-metadata.c",
"function": "dm_pool_register_metadata_threshold"
}
},
{
"id": "CVE-2022-50092-2f393afe",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e4dbe24f4bfd8377e7ba79fdcdb7c4d6eb1c6790",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"16529511490967792599669371931843741040",
"297114256853781335659224176034712310776",
"113720803604668716485215466463148646942",
"4855201950401957708749467998283793346",
"308852000970892712432794245964722370818",
"129335565632235321763874397543097556867"
]
},
"deprecated": false,
"target": {
"file": "drivers/md/dm-thin-metadata.c"
}
},
{
"id": "CVE-2022-50092-32ebc094",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3534e5a5ed2997ca1b00f44a0378a075bd05e8a3",
"signature_type": "Function",
"digest": {
"function_hash": "249858341471208346482158551493190612383",
"length": 2768.0
},
"deprecated": false,
"target": {
"file": "drivers/md/dm-thin.c",
"function": "pool_ctr"
}
},
{
"id": "CVE-2022-50092-3906e317",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@05cef0999b3208b5a6ede1bfac855139e4de55ef",
"signature_type": "Function",
"digest": {
"function_hash": "59074473449400742917679790223617021667",
"length": 213.0
},
"deprecated": false,
"target": {
"file": "drivers/md/dm-thin-metadata.c",
"function": "dm_pool_register_metadata_threshold"
}
},
{
"id": "CVE-2022-50092-4448a635",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@05cef0999b3208b5a6ede1bfac855139e4de55ef",
"signature_type": "Function",
"digest": {
"function_hash": "152063243543700267461235515810741181441",
"length": 2855.0
},
"deprecated": false,
"target": {
"file": "drivers/md/dm-thin.c",
"function": "pool_ctr"
}
},
{
"id": "CVE-2022-50092-4b67b2ac",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3534e5a5ed2997ca1b00f44a0378a075bd05e8a3",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"30150166429201985097763208018852617551",
"155397136384879686460318878852014603421",
"273977688126330814617688085524651016023",
"313378237857658491376535391438551343071",
"294664963946119690832316526080174507177"
]
},
"deprecated": false,
"target": {
"file": "drivers/md/dm-thin.c"
}
},
{
"id": "CVE-2022-50092-5c1e221f",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5e2cf705155a1514be3c96ea664a9cd356998ee7",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"30150166429201985097763208018852617551",
"155397136384879686460318878852014603421",
"273977688126330814617688085524651016023",
"313378237857658491376535391438551343071",
"294664963946119690832316526080174507177"
]
},
"deprecated": false,
"target": {
"file": "drivers/md/dm-thin.c"
}
},
{
"id": "CVE-2022-50092-604244e1",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f83131a3071a0b61a4d7dca70f95adb3ffad920e",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"30150166429201985097763208018852617551",
"155397136384879686460318878852014603421",
"273977688126330814617688085524651016023",
"313378237857658491376535391438551343071",
"294664963946119690832316526080174507177"
]
},
"deprecated": false,
"target": {
"file": "drivers/md/dm-thin.c"
}
},
{
"id": "CVE-2022-50092-73eeea52",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1a199fa9217d28511ff88529238fd9980ea64cf3",
"signature_type": "Function",
"digest": {
"function_hash": "59074473449400742917679790223617021667",
"length": 213.0
},
"deprecated": false,
"target": {
"file": "drivers/md/dm-thin-metadata.c",
"function": "dm_pool_register_metadata_threshold"
}
},
{
"id": "CVE-2022-50092-790c3e7c",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e4dbe24f4bfd8377e7ba79fdcdb7c4d6eb1c6790",
"signature_type": "Function",
"digest": {
"function_hash": "59074473449400742917679790223617021667",
"length": 213.0
},
"deprecated": false,
"target": {
"file": "drivers/md/dm-thin-metadata.c",
"function": "dm_pool_register_metadata_threshold"
}
},
{
"id": "CVE-2022-50092-7d637c14",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5e2cf705155a1514be3c96ea664a9cd356998ee7",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"16529511490967792599669371931843741040",
"297114256853781335659224176034712310776",
"113720803604668716485215466463148646942",
"4855201950401957708749467998283793346",
"308852000970892712432794245964722370818",
"129335565632235321763874397543097556867"
]
},
"deprecated": false,
"target": {
"file": "drivers/md/dm-thin-metadata.c"
}
},
{
"id": "CVE-2022-50092-8884055c",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5e2cf705155a1514be3c96ea664a9cd356998ee7",
"signature_type": "Function",
"digest": {
"function_hash": "59074473449400742917679790223617021667",
"length": 213.0
},
"deprecated": false,
"target": {
"file": "drivers/md/dm-thin-metadata.c",
"function": "dm_pool_register_metadata_threshold"
}
},
{
"id": "CVE-2022-50092-8a354271",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e4dbe24f4bfd8377e7ba79fdcdb7c4d6eb1c6790",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"30150166429201985097763208018852617551",
"155397136384879686460318878852014603421",
"273977688126330814617688085524651016023",
"313378237857658491376535391438551343071",
"294664963946119690832316526080174507177"
]
},
"deprecated": false,
"target": {
"file": "drivers/md/dm-thin.c"
}
},
{
"id": "CVE-2022-50092-a573e38e",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1a199fa9217d28511ff88529238fd9980ea64cf3",
"signature_type": "Function",
"digest": {
"function_hash": "249858341471208346482158551493190612383",
"length": 2768.0
},
"deprecated": false,
"target": {
"file": "drivers/md/dm-thin.c",
"function": "pool_ctr"
}
},
{
"id": "CVE-2022-50092-aa193cc0",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5e2cf705155a1514be3c96ea664a9cd356998ee7",
"signature_type": "Function",
"digest": {
"function_hash": "249858341471208346482158551493190612383",
"length": 2768.0
},
"deprecated": false,
"target": {
"file": "drivers/md/dm-thin.c",
"function": "pool_ctr"
}
},
{
"id": "CVE-2022-50092-b60e87e3",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@05cef0999b3208b5a6ede1bfac855139e4de55ef",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"30150166429201985097763208018852617551",
"155397136384879686460318878852014603421",
"214722384141479523191889748430717268001",
"199942414585114662465767485802095789716",
"101897396438932321802640031684457681286"
]
},
"deprecated": false,
"target": {
"file": "drivers/md/dm-thin.c"
}
},
{
"id": "CVE-2022-50092-cf713c6e",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3534e5a5ed2997ca1b00f44a0378a075bd05e8a3",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"16529511490967792599669371931843741040",
"297114256853781335659224176034712310776",
"113720803604668716485215466463148646942",
"4855201950401957708749467998283793346",
"308852000970892712432794245964722370818",
"129335565632235321763874397543097556867"
]
},
"deprecated": false,
"target": {
"file": "drivers/md/dm-thin-metadata.c"
}
},
{
"id": "CVE-2022-50092-d2439ae0",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e4dbe24f4bfd8377e7ba79fdcdb7c4d6eb1c6790",
"signature_type": "Function",
"digest": {
"function_hash": "249858341471208346482158551493190612383",
"length": 2768.0
},
"deprecated": false,
"target": {
"file": "drivers/md/dm-thin.c",
"function": "pool_ctr"
}
},
{
"id": "CVE-2022-50092-e3bcac93",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f83131a3071a0b61a4d7dca70f95adb3ffad920e",
"signature_type": "Function",
"digest": {
"function_hash": "249858341471208346482158551493190612383",
"length": 2768.0
},
"deprecated": false,
"target": {
"file": "drivers/md/dm-thin.c",
"function": "pool_ctr"
}
},
{
"id": "CVE-2022-50092-f21d9d72",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@05cef0999b3208b5a6ede1bfac855139e4de55ef",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"16529511490967792599669371931843741040",
"297114256853781335659224176034712310776",
"113720803604668716485215466463148646942",
"4855201950401957708749467998283793346",
"308852000970892712432794245964722370818",
"129335565632235321763874397543097556867"
]
},
"deprecated": false,
"target": {
"file": "drivers/md/dm-thin-metadata.c"
}
},
{
"id": "CVE-2022-50092-fae51066",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f83131a3071a0b61a4d7dca70f95adb3ffad920e",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"16529511490967792599669371931843741040",
"297114256853781335659224176034712310776",
"113720803604668716485215466463148646942",
"4855201950401957708749467998283793346",
"308852000970892712432794245964722370818",
"129335565632235321763874397543097556867"
]
},
"deprecated": false,
"target": {
"file": "drivers/md/dm-thin-metadata.c"
}
},
{
"id": "CVE-2022-50092-fceae5ef",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1a199fa9217d28511ff88529238fd9980ea64cf3",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"30150166429201985097763208018852617551",
"155397136384879686460318878852014603421",
"273977688126330814617688085524651016023",
"313378237857658491376535391438551343071",
"294664963946119690832316526080174507177"
]
},
"deprecated": false,
"target": {
"file": "drivers/md/dm-thin.c"
}
}
]