In the Linux kernel, the following vulnerability has been resolved:
dm thin: fix use-after-free crash in dmsmregisterthresholdcallback
Fault inject on pool metadata device reports: BUG: KASAN: use-after-free in dmpoolregistermetadatathreshold+0x40/0x80 Read of size 8 at addr ffff8881b9d50068 by task dmsetup/950
CPU: 7 PID: 950 Comm: dmsetup Tainted: G W 5.19.0-rc6 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014 Call Trace: <TASK> dumpstacklvl+0x34/0x44 printaddressdescription.constprop.0.cold+0xeb/0x3f4 kasanreport.cold+0xe6/0x147 dmpoolregistermetadatathreshold+0x40/0x80 poolctr+0xa0a/0x1150 dmtableaddtarget+0x2c8/0x640 tableload+0x1fd/0x430 ctlioctl+0x2c4/0x5a0 dmctlioctl+0xa/0x10 _x64sysioctl+0xb3/0xd0 dosyscall64+0x35/0x80 entrySYSCALL64afterhwframe+0x46/0xb0
This can be easily reproduced using: echo offline > /sys/block/sda/device/state dd if=/dev/zero of=/dev/mapper/thin bs=4k count=10 dmsetup load pool --table "0 20971520 thin-pool /dev/sda /dev/sdb 128 0 0"
If a metadata commit fails, the transaction will be aborted and the metadata space maps will be destroyed. If a DM table reload then happens for this failed thin-pool, a use-after-free will occur in dmsmregisterthresholdcallback (called from dmpoolregistermetadatathreshold).
Fix this by in dmpoolregistermetadatathreshold() by returning the -EINVAL error if the thin-pool is in fail mode. Also fail pool_ctr() with a new error message: "Error registering metadata threshold".
[ { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f83131a3071a0b61a4d7dca70f95adb3ffad920e", "target": { "function": "dm_pool_register_metadata_threshold", "file": "drivers/md/dm-thin-metadata.c" }, "signature_version": "v1", "deprecated": false, "id": "CVE-2022-50092-035c907b", "signature_type": "Function", "digest": { "function_hash": "59074473449400742917679790223617021667", "length": 213.0 } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1a199fa9217d28511ff88529238fd9980ea64cf3", "target": { "file": "drivers/md/dm-thin-metadata.c" }, "signature_version": "v1", "deprecated": false, "id": "CVE-2022-50092-0bc01f00", "signature_type": "Line", "digest": { "line_hashes": [ "16529511490967792599669371931843741040", "297114256853781335659224176034712310776", "113720803604668716485215466463148646942", "4855201950401957708749467998283793346", "308852000970892712432794245964722370818", "129335565632235321763874397543097556867" ], "threshold": 0.9 } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3534e5a5ed2997ca1b00f44a0378a075bd05e8a3", "target": { "function": "dm_pool_register_metadata_threshold", "file": "drivers/md/dm-thin-metadata.c" }, "signature_version": "v1", "deprecated": false, "id": "CVE-2022-50092-223b73d3", "signature_type": "Function", "digest": { "function_hash": "59074473449400742917679790223617021667", "length": 213.0 } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e4dbe24f4bfd8377e7ba79fdcdb7c4d6eb1c6790", "target": { "file": "drivers/md/dm-thin-metadata.c" }, "signature_version": "v1", "deprecated": false, "id": "CVE-2022-50092-2f393afe", "signature_type": "Line", "digest": { "line_hashes": [ "16529511490967792599669371931843741040", "297114256853781335659224176034712310776", "113720803604668716485215466463148646942", "4855201950401957708749467998283793346", "308852000970892712432794245964722370818", "129335565632235321763874397543097556867" ], "threshold": 0.9 } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3534e5a5ed2997ca1b00f44a0378a075bd05e8a3", "target": { "function": "pool_ctr", "file": "drivers/md/dm-thin.c" }, "signature_version": "v1", "deprecated": false, "id": "CVE-2022-50092-32ebc094", "signature_type": "Function", "digest": { "function_hash": "249858341471208346482158551493190612383", "length": 2768.0 } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@05cef0999b3208b5a6ede1bfac855139e4de55ef", "target": { "function": "dm_pool_register_metadata_threshold", "file": "drivers/md/dm-thin-metadata.c" }, "signature_version": "v1", "deprecated": false, "id": "CVE-2022-50092-3906e317", "signature_type": "Function", "digest": { "function_hash": "59074473449400742917679790223617021667", "length": 213.0 } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@05cef0999b3208b5a6ede1bfac855139e4de55ef", "target": { "function": "pool_ctr", "file": "drivers/md/dm-thin.c" }, "signature_version": "v1", "deprecated": false, "id": "CVE-2022-50092-4448a635", "signature_type": "Function", "digest": { "function_hash": "152063243543700267461235515810741181441", "length": 2855.0 } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3534e5a5ed2997ca1b00f44a0378a075bd05e8a3", "target": { "file": "drivers/md/dm-thin.c" }, "signature_version": "v1", "deprecated": false, "id": "CVE-2022-50092-4b67b2ac", "signature_type": "Line", "digest": { "line_hashes": [ "30150166429201985097763208018852617551", "155397136384879686460318878852014603421", "273977688126330814617688085524651016023", "313378237857658491376535391438551343071", "294664963946119690832316526080174507177" ], "threshold": 0.9 } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5e2cf705155a1514be3c96ea664a9cd356998ee7", "target": { "file": "drivers/md/dm-thin.c" }, "signature_version": "v1", "deprecated": false, "id": "CVE-2022-50092-5c1e221f", "signature_type": "Line", "digest": { "line_hashes": [ "30150166429201985097763208018852617551", "155397136384879686460318878852014603421", "273977688126330814617688085524651016023", "313378237857658491376535391438551343071", "294664963946119690832316526080174507177" ], "threshold": 0.9 } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f83131a3071a0b61a4d7dca70f95adb3ffad920e", "target": { "file": "drivers/md/dm-thin.c" }, "signature_version": "v1", "deprecated": false, "id": "CVE-2022-50092-604244e1", "signature_type": "Line", "digest": { "line_hashes": [ "30150166429201985097763208018852617551", "155397136384879686460318878852014603421", "273977688126330814617688085524651016023", "313378237857658491376535391438551343071", "294664963946119690832316526080174507177" ], "threshold": 0.9 } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1a199fa9217d28511ff88529238fd9980ea64cf3", "target": { "function": "dm_pool_register_metadata_threshold", "file": "drivers/md/dm-thin-metadata.c" }, "signature_version": "v1", "deprecated": false, "id": "CVE-2022-50092-73eeea52", "signature_type": "Function", "digest": { "function_hash": "59074473449400742917679790223617021667", "length": 213.0 } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e4dbe24f4bfd8377e7ba79fdcdb7c4d6eb1c6790", "target": { "function": "dm_pool_register_metadata_threshold", "file": "drivers/md/dm-thin-metadata.c" }, "signature_version": "v1", "deprecated": false, "id": "CVE-2022-50092-790c3e7c", "signature_type": "Function", "digest": { "function_hash": "59074473449400742917679790223617021667", "length": 213.0 } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5e2cf705155a1514be3c96ea664a9cd356998ee7", "target": { "file": "drivers/md/dm-thin-metadata.c" }, "signature_version": "v1", "deprecated": false, "id": "CVE-2022-50092-7d637c14", "signature_type": "Line", "digest": { "line_hashes": [ "16529511490967792599669371931843741040", "297114256853781335659224176034712310776", "113720803604668716485215466463148646942", "4855201950401957708749467998283793346", "308852000970892712432794245964722370818", "129335565632235321763874397543097556867" ], "threshold": 0.9 } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5e2cf705155a1514be3c96ea664a9cd356998ee7", "target": { "function": "dm_pool_register_metadata_threshold", "file": "drivers/md/dm-thin-metadata.c" }, "signature_version": "v1", "deprecated": false, "id": "CVE-2022-50092-8884055c", "signature_type": "Function", "digest": { "function_hash": "59074473449400742917679790223617021667", "length": 213.0 } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e4dbe24f4bfd8377e7ba79fdcdb7c4d6eb1c6790", "target": { "file": "drivers/md/dm-thin.c" }, "signature_version": "v1", "deprecated": false, "id": "CVE-2022-50092-8a354271", "signature_type": "Line", "digest": { "line_hashes": [ "30150166429201985097763208018852617551", "155397136384879686460318878852014603421", "273977688126330814617688085524651016023", "313378237857658491376535391438551343071", "294664963946119690832316526080174507177" ], "threshold": 0.9 } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1a199fa9217d28511ff88529238fd9980ea64cf3", "target": { "function": "pool_ctr", "file": "drivers/md/dm-thin.c" }, "signature_version": "v1", "deprecated": false, "id": "CVE-2022-50092-a573e38e", "signature_type": "Function", "digest": { "function_hash": "249858341471208346482158551493190612383", "length": 2768.0 } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5e2cf705155a1514be3c96ea664a9cd356998ee7", "target": { "function": "pool_ctr", "file": "drivers/md/dm-thin.c" }, "signature_version": "v1", "deprecated": false, "id": "CVE-2022-50092-aa193cc0", "signature_type": "Function", "digest": { "function_hash": "249858341471208346482158551493190612383", "length": 2768.0 } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@05cef0999b3208b5a6ede1bfac855139e4de55ef", "target": { "file": "drivers/md/dm-thin.c" }, "signature_version": "v1", "deprecated": false, "id": "CVE-2022-50092-b60e87e3", "signature_type": "Line", "digest": { "line_hashes": [ "30150166429201985097763208018852617551", "155397136384879686460318878852014603421", "214722384141479523191889748430717268001", "199942414585114662465767485802095789716", "101897396438932321802640031684457681286" ], "threshold": 0.9 } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3534e5a5ed2997ca1b00f44a0378a075bd05e8a3", "target": { "file": "drivers/md/dm-thin-metadata.c" }, "signature_version": "v1", "deprecated": false, "id": "CVE-2022-50092-cf713c6e", "signature_type": "Line", "digest": { "line_hashes": [ "16529511490967792599669371931843741040", "297114256853781335659224176034712310776", "113720803604668716485215466463148646942", "4855201950401957708749467998283793346", "308852000970892712432794245964722370818", "129335565632235321763874397543097556867" ], "threshold": 0.9 } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e4dbe24f4bfd8377e7ba79fdcdb7c4d6eb1c6790", "target": { "function": "pool_ctr", "file": "drivers/md/dm-thin.c" }, "signature_version": "v1", "deprecated": false, "id": "CVE-2022-50092-d2439ae0", "signature_type": "Function", "digest": { "function_hash": "249858341471208346482158551493190612383", "length": 2768.0 } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f83131a3071a0b61a4d7dca70f95adb3ffad920e", "target": { "function": "pool_ctr", "file": "drivers/md/dm-thin.c" }, "signature_version": "v1", "deprecated": false, "id": "CVE-2022-50092-e3bcac93", "signature_type": "Function", "digest": { "function_hash": "249858341471208346482158551493190612383", "length": 2768.0 } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@05cef0999b3208b5a6ede1bfac855139e4de55ef", "target": { "file": "drivers/md/dm-thin-metadata.c" }, "signature_version": "v1", "deprecated": false, "id": "CVE-2022-50092-f21d9d72", "signature_type": "Line", "digest": { "line_hashes": [ "16529511490967792599669371931843741040", "297114256853781335659224176034712310776", "113720803604668716485215466463148646942", "4855201950401957708749467998283793346", "308852000970892712432794245964722370818", "129335565632235321763874397543097556867" ], "threshold": 0.9 } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f83131a3071a0b61a4d7dca70f95adb3ffad920e", "target": { "file": "drivers/md/dm-thin-metadata.c" }, "signature_version": "v1", "deprecated": false, "id": "CVE-2022-50092-fae51066", "signature_type": "Line", "digest": { "line_hashes": [ "16529511490967792599669371931843741040", "297114256853781335659224176034712310776", "113720803604668716485215466463148646942", "4855201950401957708749467998283793346", "308852000970892712432794245964722370818", "129335565632235321763874397543097556867" ], "threshold": 0.9 } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1a199fa9217d28511ff88529238fd9980ea64cf3", "target": { "file": "drivers/md/dm-thin.c" }, "signature_version": "v1", "deprecated": false, "id": "CVE-2022-50092-fceae5ef", "signature_type": "Line", "digest": { "line_hashes": [ "30150166429201985097763208018852617551", "155397136384879686460318878852014603421", "273977688126330814617688085524651016023", "313378237857658491376535391438551343071", "294664963946119690832316526080174507177" ], "threshold": 0.9 } } ]