cve-2022-48649
Vulnerability from cvelistv5
Published
2024-04-28 13:00
Modified
2024-12-19 08:05
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: mm/slab_common: fix possible double free of kmem_cache When doing slub_debug test, kfence's 'test_memcache_typesafe_by_rcu' kunit test case cause a use-after-free error: BUG: KASAN: use-after-free in kobject_del+0x14/0x30 Read of size 8 at addr ffff888007679090 by task kunit_try_catch/261 CPU: 1 PID: 261 Comm: kunit_try_catch Tainted: G B N 6.0.0-rc5-next-20220916 #17 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x34/0x48 print_address_description.constprop.0+0x87/0x2a5 print_report+0x103/0x1ed kasan_report+0xb7/0x140 kobject_del+0x14/0x30 kmem_cache_destroy+0x130/0x170 test_exit+0x1a/0x30 kunit_try_run_case+0xad/0xc0 kunit_generic_run_threadfn_adapter+0x26/0x50 kthread+0x17b/0x1b0 </TASK> The cause is inside kmem_cache_destroy(): kmem_cache_destroy acquire lock/mutex shutdown_cache schedule_work(kmem_cache_release) (if RCU flag set) release lock/mutex kmem_cache_release (if RCU flag not set) In some certain timing, the scheduled work could be run before the next RCU flag checking, which can then get a wrong value and lead to double kmem_cache_release(). Fix it by caching the RCU flag inside protected area, just like 'refcnt'
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/c673c6ceac53fb2e631c9fbbd79957099a08927fPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d71608a877362becdc94191f190902fac1e64d35Patch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/c673c6ceac53fb2e631c9fbbd79957099a08927fPatch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/d71608a877362becdc94191f190902fac1e64d35Patch
Impacted products
Vendor Product Version
Linux Linux Version: 357321557920c805de2b14832002465c320eea4f
Version: 0495e337b7039191dfce6e03f5f830454b1fae6b
 Create a notification for this product.
   Linux Linux Version: 5.19.8   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T15:17:55.556Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://git.kernel.org/stable/c/c673c6ceac53fb2e631c9fbbd79957099a08927f",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://git.kernel.org/stable/c/d71608a877362becdc94191f190902fac1e64d35",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-48649",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-09-10T15:46:11.220120Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-09-11T17:33:10.427Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "Linux",
               programFiles: [
                  "mm/slab_common.c",
               ],
               repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               vendor: "Linux",
               versions: [
                  {
                     lessThan: "c673c6ceac53fb2e631c9fbbd79957099a08927f",
                     status: "affected",
                     version: "357321557920c805de2b14832002465c320eea4f",
                     versionType: "git",
                  },
                  {
                     lessThan: "d71608a877362becdc94191f190902fac1e64d35",
                     status: "affected",
                     version: "0495e337b7039191dfce6e03f5f830454b1fae6b",
                     versionType: "git",
                  },
               ],
            },
            {
               defaultStatus: "unaffected",
               product: "Linux",
               programFiles: [
                  "mm/slab_common.c",
               ],
               repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               vendor: "Linux",
               versions: [
                  {
                     lessThan: "5.19.12",
                     status: "affected",
                     version: "5.19.8",
                     versionType: "semver",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/slab_common: fix possible double free of kmem_cache\n\nWhen doing slub_debug test, kfence's 'test_memcache_typesafe_by_rcu'\nkunit test case cause a use-after-free error:\n\n  BUG: KASAN: use-after-free in kobject_del+0x14/0x30\n  Read of size 8 at addr ffff888007679090 by task kunit_try_catch/261\n\n  CPU: 1 PID: 261 Comm: kunit_try_catch Tainted: G    B            N 6.0.0-rc5-next-20220916 #17\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\n  Call Trace:\n   <TASK>\n   dump_stack_lvl+0x34/0x48\n   print_address_description.constprop.0+0x87/0x2a5\n   print_report+0x103/0x1ed\n   kasan_report+0xb7/0x140\n   kobject_del+0x14/0x30\n   kmem_cache_destroy+0x130/0x170\n   test_exit+0x1a/0x30\n   kunit_try_run_case+0xad/0xc0\n   kunit_generic_run_threadfn_adapter+0x26/0x50\n   kthread+0x17b/0x1b0\n   </TASK>\n\nThe cause is inside kmem_cache_destroy():\n\nkmem_cache_destroy\n    acquire lock/mutex\n    shutdown_cache\n        schedule_work(kmem_cache_release) (if RCU flag set)\n    release lock/mutex\n    kmem_cache_release (if RCU flag not set)\n\nIn some certain timing, the scheduled work could be run before\nthe next RCU flag checking, which can then get a wrong value\nand lead to double kmem_cache_release().\n\nFix it by caching the RCU flag inside protected area, just like 'refcnt'",
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-12-19T08:05:02.082Z",
            orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            shortName: "Linux",
         },
         references: [
            {
               url: "https://git.kernel.org/stable/c/c673c6ceac53fb2e631c9fbbd79957099a08927f",
            },
            {
               url: "https://git.kernel.org/stable/c/d71608a877362becdc94191f190902fac1e64d35",
            },
         ],
         title: "mm/slab_common: fix possible double free of kmem_cache",
         x_generator: {
            engine: "bippy-5f407fcff5a0",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      assignerShortName: "Linux",
      cveId: "CVE-2022-48649",
      datePublished: "2024-04-28T13:00:33.390Z",
      dateReserved: "2024-02-25T13:44:28.316Z",
      dateUpdated: "2024-12-19T08:05:02.082Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      nvd: "{\"cve\":{\"id\":\"CVE-2022-48649\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-04-28T13:15:07.333\",\"lastModified\":\"2025-01-10T17:49:53.747\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm/slab_common: fix possible double free of kmem_cache\\n\\nWhen doing slub_debug test, kfence's 'test_memcache_typesafe_by_rcu'\\nkunit test case cause a use-after-free error:\\n\\n  BUG: KASAN: use-after-free in kobject_del+0x14/0x30\\n  Read of size 8 at addr ffff888007679090 by task kunit_try_catch/261\\n\\n  CPU: 1 PID: 261 Comm: kunit_try_catch Tainted: G    B            N 6.0.0-rc5-next-20220916 #17\\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\\n  Call Trace:\\n   <TASK>\\n   dump_stack_lvl+0x34/0x48\\n   print_address_description.constprop.0+0x87/0x2a5\\n   print_report+0x103/0x1ed\\n   kasan_report+0xb7/0x140\\n   kobject_del+0x14/0x30\\n   kmem_cache_destroy+0x130/0x170\\n   test_exit+0x1a/0x30\\n   kunit_try_run_case+0xad/0xc0\\n   kunit_generic_run_threadfn_adapter+0x26/0x50\\n   kthread+0x17b/0x1b0\\n   </TASK>\\n\\nThe cause is inside kmem_cache_destroy():\\n\\nkmem_cache_destroy\\n    acquire lock/mutex\\n    shutdown_cache\\n        schedule_work(kmem_cache_release) (if RCU flag set)\\n    release lock/mutex\\n    kmem_cache_release (if RCU flag not set)\\n\\nIn some certain timing, the scheduled work could be run before\\nthe next RCU flag checking, which can then get a wrong value\\nand lead to double kmem_cache_release().\\n\\nFix it by caching the RCU flag inside protected area, just like 'refcnt'\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mm/slab_common: corrección posible doble liberación de kmem_cache Al realizar la prueba slub_debug, el caso de prueba kunit 'test_memcache_typesafe_by_rcu' de kfence causa un error de use-after-free: ERROR: KASAN: uso después -free en kobject_del+0x14/0x30 Lectura de tamaño 8 en addr ffff888007679090 por tarea kunit_try_catch/261 CPU: 1 PID: 261 Comm: kunit_try_catch Contaminado: GBN 6.0.0-rc5-next-20220916 #17 Nombre de hardware: PC estándar QEMU ( I440FX+PIIX, 1996), BIOS 1.15.0-1 04/01/2014 TRACE DE LLAMADA:  dump_stack_lvl+0x34/0x48 print_address_description.constprop.0+0x87/0x2a5 print_rePort+0x103/0x1ed kasan_report+0xb7/0x140/0x140/0x140+0xb7/0x140/0x140/0x140/0x14/0x140/0xil 0x14/0x30 kmem_cache_destroy+0x130/0x170 test_exit+0x1a/0x30 kunit_try_run_case+0xad/0xc0 kunit_generic_run_threadfn_adapter+0x26/0x50 kthread+0x17b/0x1b0  La causa está dentro de kmem_cache_destroy (): kmem_cache_destroy adquirir bloqueo/mutex Shutdown_cache Schedule_work(kmem_cache_release) (si el indicador RCU está establecido) liberar bloqueo/mutex kmem_cache_release (si el indicador RCU no está establecido) En un momento determinado, el trabajo programado podría ejecutarse antes de la siguiente verificación del indicador RCU, lo que luego puede obtener un valor incorrecto y provocar un doble kmem_cache_release() . Solucionarlo almacenando en caché la bandera RCU dentro del área protegida, como 'refcnt'\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-415\"},{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.19.8\",\"versionEndExcluding\":\"5.19.12\",\"matchCriteriaId\":\"2D03C438-AFC6-4552-81FB-6D089B245FD7\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/c673c6ceac53fb2e631c9fbbd79957099a08927f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d71608a877362becdc94191f190902fac1e64d35\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c673c6ceac53fb2e631c9fbbd79957099a08927f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d71608a877362becdc94191f190902fac1e64d35\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
      vulnrichment: {
         containers: "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/c673c6ceac53fb2e631c9fbbd79957099a08927f\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/d71608a877362becdc94191f190902fac1e64d35\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T15:17:55.556Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-48649\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T15:46:11.220120Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:14.966Z\"}}], \"cna\": {\"title\": \"mm/slab_common: fix possible double free of kmem_cache\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"357321557920c805de2b14832002465c320eea4f\", \"lessThan\": \"c673c6ceac53fb2e631c9fbbd79957099a08927f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0495e337b7039191dfce6e03f5f830454b1fae6b\", \"lessThan\": \"d71608a877362becdc94191f190902fac1e64d35\", \"versionType\": \"git\"}], \"programFiles\": [\"mm/slab_common.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.19.8\", \"lessThan\": \"5.19.12\", \"versionType\": \"semver\"}], \"programFiles\": [\"mm/slab_common.c\"], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/c673c6ceac53fb2e631c9fbbd79957099a08927f\"}, {\"url\": \"https://git.kernel.org/stable/c/d71608a877362becdc94191f190902fac1e64d35\"}], \"x_generator\": {\"engine\": \"bippy-5f407fcff5a0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm/slab_common: fix possible double free of kmem_cache\\n\\nWhen doing slub_debug test, kfence's 'test_memcache_typesafe_by_rcu'\\nkunit test case cause a use-after-free error:\\n\\n  BUG: KASAN: use-after-free in kobject_del+0x14/0x30\\n  Read of size 8 at addr ffff888007679090 by task kunit_try_catch/261\\n\\n  CPU: 1 PID: 261 Comm: kunit_try_catch Tainted: G    B            N 6.0.0-rc5-next-20220916 #17\\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\\n  Call Trace:\\n   <TASK>\\n   dump_stack_lvl+0x34/0x48\\n   print_address_description.constprop.0+0x87/0x2a5\\n   print_report+0x103/0x1ed\\n   kasan_report+0xb7/0x140\\n   kobject_del+0x14/0x30\\n   kmem_cache_destroy+0x130/0x170\\n   test_exit+0x1a/0x30\\n   kunit_try_run_case+0xad/0xc0\\n   kunit_generic_run_threadfn_adapter+0x26/0x50\\n   kthread+0x17b/0x1b0\\n   </TASK>\\n\\nThe cause is inside kmem_cache_destroy():\\n\\nkmem_cache_destroy\\n    acquire lock/mutex\\n    shutdown_cache\\n        schedule_work(kmem_cache_release) (if RCU flag set)\\n    release lock/mutex\\n    kmem_cache_release (if RCU flag not set)\\n\\nIn some certain timing, the scheduled work could be run before\\nthe next RCU flag checking, which can then get a wrong value\\nand lead to double kmem_cache_release().\\n\\nFix it by caching the RCU flag inside protected area, just like 'refcnt'\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-12-19T08:05:02.082Z\"}}}",
         cveMetadata: "{\"cveId\": \"CVE-2022-48649\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-12-19T08:05:02.082Z\", \"dateReserved\": \"2024-02-25T13:44:28.316Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-04-28T13:00:33.390Z\", \"assignerShortName\": \"Linux\"}",
         dataType: "CVE_RECORD",
         dataVersion: "5.1",
      },
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.