cve-2022-48925
Vulnerability from cvelistv5
Published
2024-08-22 01:33
Modified
2024-12-19 08:10
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/cma: Do not change route.addr.src_addr outside state checks
If the state is not idle then resolve_prepare_src() should immediately
fail and no change to global state should happen. However, it
unconditionally overwrites the src_addr trying to build a temporary any
address.
For instance if the state is already RDMA_CM_LISTEN then this will corrupt
the src_addr and would cause the test in cma_cancel_operation():
if (cma_any_addr(cma_src_addr(id_priv)) && !id_priv->cma_dev)
Which would manifest as this trace from syzkaller:
BUG: KASAN: use-after-free in __list_add_valid+0x93/0xa0 lib/list_debug.c:26
Read of size 8 at addr ffff8881546491e0 by task syz-executor.1/32204
CPU: 1 PID: 32204 Comm: syz-executor.1 Not tainted 5.12.0-rc8-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:79 [inline]
dump_stack+0x141/0x1d7 lib/dump_stack.c:120
print_address_description.constprop.0.cold+0x5b/0x2f8 mm/kasan/report.c:232
__kasan_report mm/kasan/report.c:399 [inline]
kasan_report.cold+0x7c/0xd8 mm/kasan/report.c:416
__list_add_valid+0x93/0xa0 lib/list_debug.c:26
__list_add include/linux/list.h:67 [inline]
list_add_tail include/linux/list.h:100 [inline]
cma_listen_on_all drivers/infiniband/core/cma.c:2557 [inline]
rdma_listen+0x787/0xe00 drivers/infiniband/core/cma.c:3751
ucma_listen+0x16a/0x210 drivers/infiniband/core/ucma.c:1102
ucma_write+0x259/0x350 drivers/infiniband/core/ucma.c:1732
vfs_write+0x28e/0xa30 fs/read_write.c:603
ksys_write+0x1ee/0x250 fs/read_write.c:658
do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xae
This is indicating that an rdma_id_private was destroyed without doing
cma_cancel_listens().
Instead of trying to re-use the src_addr memory to indirectly create an
any address derived from the dst build one explicitly on the stack and
bind to that as any other normal flow would do. rdma_bind_addr() will copy
it over the src_addr once it knows the state is valid.
This is similar to commit bc0bdc5afaa7 ("RDMA/cma: Do not change
route.addr.src_addr.ss_family")
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-48925",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-10T15:33:15.605399Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-12T17:33:11.068Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/core/cma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5b1cef5798b4fd6e4fd5522e7b8a26248beeacaa",
"status": "affected",
"version": "732d41c545bb359cbb8c94698bdc1f8bcf82279c",
"versionType": "git"
},
{
"lessThan": "00265efbd3e5705038c9492a434fda8cf960c8a2",
"status": "affected",
"version": "732d41c545bb359cbb8c94698bdc1f8bcf82279c",
"versionType": "git"
},
{
"lessThan": "d350724795c7a48b05bf921d94699fbfecf7da0b",
"status": "affected",
"version": "732d41c545bb359cbb8c94698bdc1f8bcf82279c",
"versionType": "git"
},
{
"lessThan": "22e9f71072fa605cbf033158db58e0790101928d",
"status": "affected",
"version": "732d41c545bb359cbb8c94698bdc1f8bcf82279c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/core/cma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.10"
},
{
"lessThan": "5.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.26",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.16.*",
"status": "unaffected",
"version": "5.16.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "5.17",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/cma: Do not change route.addr.src_addr outside state checks\n\nIf the state is not idle then resolve_prepare_src() should immediately\nfail and no change to global state should happen. However, it\nunconditionally overwrites the src_addr trying to build a temporary any\naddress.\n\nFor instance if the state is already RDMA_CM_LISTEN then this will corrupt\nthe src_addr and would cause the test in cma_cancel_operation():\n\n if (cma_any_addr(cma_src_addr(id_priv)) \u0026\u0026 !id_priv-\u003ecma_dev)\n\nWhich would manifest as this trace from syzkaller:\n\n BUG: KASAN: use-after-free in __list_add_valid+0x93/0xa0 lib/list_debug.c:26\n Read of size 8 at addr ffff8881546491e0 by task syz-executor.1/32204\n\n CPU: 1 PID: 32204 Comm: syz-executor.1 Not tainted 5.12.0-rc8-syzkaller #0\n Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\n Call Trace:\n __dump_stack lib/dump_stack.c:79 [inline]\n dump_stack+0x141/0x1d7 lib/dump_stack.c:120\n print_address_description.constprop.0.cold+0x5b/0x2f8 mm/kasan/report.c:232\n __kasan_report mm/kasan/report.c:399 [inline]\n kasan_report.cold+0x7c/0xd8 mm/kasan/report.c:416\n __list_add_valid+0x93/0xa0 lib/list_debug.c:26\n __list_add include/linux/list.h:67 [inline]\n list_add_tail include/linux/list.h:100 [inline]\n cma_listen_on_all drivers/infiniband/core/cma.c:2557 [inline]\n rdma_listen+0x787/0xe00 drivers/infiniband/core/cma.c:3751\n ucma_listen+0x16a/0x210 drivers/infiniband/core/ucma.c:1102\n ucma_write+0x259/0x350 drivers/infiniband/core/ucma.c:1732\n vfs_write+0x28e/0xa30 fs/read_write.c:603\n ksys_write+0x1ee/0x250 fs/read_write.c:658\n do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46\n entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nThis is indicating that an rdma_id_private was destroyed without doing\ncma_cancel_listens().\n\nInstead of trying to re-use the src_addr memory to indirectly create an\nany address derived from the dst build one explicitly on the stack and\nbind to that as any other normal flow would do. rdma_bind_addr() will copy\nit over the src_addr once it knows the state is valid.\n\nThis is similar to commit bc0bdc5afaa7 (\"RDMA/cma: Do not change\nroute.addr.src_addr.ss_family\")"
}
],
"providerMetadata": {
"dateUpdated": "2024-12-19T08:10:38.311Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5b1cef5798b4fd6e4fd5522e7b8a26248beeacaa"
},
{
"url": "https://git.kernel.org/stable/c/00265efbd3e5705038c9492a434fda8cf960c8a2"
},
{
"url": "https://git.kernel.org/stable/c/d350724795c7a48b05bf921d94699fbfecf7da0b"
},
{
"url": "https://git.kernel.org/stable/c/22e9f71072fa605cbf033158db58e0790101928d"
}
],
"title": "RDMA/cma: Do not change route.addr.src_addr outside state checks",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2022-48925",
"datePublished": "2024-08-22T01:33:11.172Z",
"dateReserved": "2024-08-21T06:06:23.296Z",
"dateUpdated": "2024-12-19T08:10:38.311Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2022-48925\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-08-22T02:15:08.750\",\"lastModified\":\"2024-08-23T02:07:41.047\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nRDMA/cma: Do not change route.addr.src_addr outside state checks\\n\\nIf the state is not idle then resolve_prepare_src() should immediately\\nfail and no change to global state should happen. However, it\\nunconditionally overwrites the src_addr trying to build a temporary any\\naddress.\\n\\nFor instance if the state is already RDMA_CM_LISTEN then this will corrupt\\nthe src_addr and would cause the test in cma_cancel_operation():\\n\\n if (cma_any_addr(cma_src_addr(id_priv)) \u0026\u0026 !id_priv-\u003ecma_dev)\\n\\nWhich would manifest as this trace from syzkaller:\\n\\n BUG: KASAN: use-after-free in __list_add_valid+0x93/0xa0 lib/list_debug.c:26\\n Read of size 8 at addr ffff8881546491e0 by task syz-executor.1/32204\\n\\n CPU: 1 PID: 32204 Comm: syz-executor.1 Not tainted 5.12.0-rc8-syzkaller #0\\n Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\\n Call Trace:\\n __dump_stack lib/dump_stack.c:79 [inline]\\n dump_stack+0x141/0x1d7 lib/dump_stack.c:120\\n print_address_description.constprop.0.cold+0x5b/0x2f8 mm/kasan/report.c:232\\n __kasan_report mm/kasan/report.c:399 [inline]\\n kasan_report.cold+0x7c/0xd8 mm/kasan/report.c:416\\n __list_add_valid+0x93/0xa0 lib/list_debug.c:26\\n __list_add include/linux/list.h:67 [inline]\\n list_add_tail include/linux/list.h:100 [inline]\\n cma_listen_on_all drivers/infiniband/core/cma.c:2557 [inline]\\n rdma_listen+0x787/0xe00 drivers/infiniband/core/cma.c:3751\\n ucma_listen+0x16a/0x210 drivers/infiniband/core/ucma.c:1102\\n ucma_write+0x259/0x350 drivers/infiniband/core/ucma.c:1732\\n vfs_write+0x28e/0xa30 fs/read_write.c:603\\n ksys_write+0x1ee/0x250 fs/read_write.c:658\\n do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46\\n entry_SYSCALL_64_after_hwframe+0x44/0xae\\n\\nThis is indicating that an rdma_id_private was destroyed without doing\\ncma_cancel_listens().\\n\\nInstead of trying to re-use the src_addr memory to indirectly create an\\nany address derived from the dst build one explicitly on the stack and\\nbind to that as any other normal flow would do. rdma_bind_addr() will copy\\nit over the src_addr once it knows the state is valid.\\n\\nThis is similar to commit bc0bdc5afaa7 (\\\"RDMA/cma: Do not change\\nroute.addr.src_addr.ss_family\\\")\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: RDMA/cma: no cambie route.addr.src_addr fuera de las comprobaciones de estado. Si el estado no est\u00e1 inactivo, resolve_prepare_src() deber\u00eda fallar inmediatamente y no deber\u00eda ocurrir ning\u00fan cambio en el estado global. Sin embargo, sobrescribe incondicionalmente src_addr al intentar crear una direcci\u00f3n temporal. Por ejemplo, si el estado ya es RDMA_CM_LISTEN, esto da\u00f1ar\u00e1 src_addr y provocar\u00e1 la prueba en cma_cancel_operation(): if (cma_any_addr(cma_src_addr(id_priv)) \u0026amp;\u0026amp; !id_priv-\u0026gt;cma_dev) Lo que se manifestar\u00eda como este rastro de syzkaller: ERROR : KASAN: use-after-free en __list_add_valid+0x93/0xa0 lib/list_debug.c:26 Lectura de tama\u00f1o 8 en addr ffff8881546491e0 por tarea syz-executor.1/32204 CPU: 1 PID: 32204 Comm: syz-executor.1 No contaminado 5.12.0-rc8-syzkaller #0 Nombre del hardware: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Seguimiento de llamadas: __dump_stack lib/dump_stack.c:79 [en l\u00ednea] dump_stack+0x141/0x1d7 lib /dump_stack.c:120 print_address_description.constprop.0.cold+0x5b/0x2f8 mm/kasan/report.c:232 __kasan_report mm/kasan/report.c:399 [en l\u00ednea] kasan_report.cold+0x7c/0xd8 mm/kasan/ report.c:416 __list_add_valid+0x93/0xa0 lib/list_debug.c:26 __list_add include/linux/list.h:67 [en l\u00ednea] list_add_tail include/linux/list.h:100 [en l\u00ednea] cma_listen_on_all drivers/infiniband/core/ cma.c:2557 [en l\u00ednea] rdma_listen+0x787/0xe00 controladores/infiniband/core/cma.c:3751 ucma_listen+0x16a/0x210 controladores/infiniband/core/ucma.c:1102 ucma_write+0x259/0x350 controladores/infiniband/core /ucma.c:1732 vfs_write+0x28e/0xa30 fs/read_write.c:603 ksys_write+0x1ee/0x250 fs/read_write.c:658 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 Entry_SYSCALL_64_after_hwframe+0x44/ 0xae Esto indica que un rdma_id_private fue destruido sin realizar cma_cancel_listens(). En lugar de intentar reutilizar la memoria src_addr para crear indirectamente cualquier direcci\u00f3n derivada del dst, cree una expl\u00edcitamente en la pila y vinc\u00falela como lo har\u00eda cualquier otro flujo normal. rdma_bind_addr() lo copiar\u00e1 sobre src_addr una vez que sepa que el estado es v\u00e1lido. Esto es similar al commit bc0bdc5afaa7 (\\\"RDMA/cma: No cambiar route.addr.src_addr.ss_family\\\")\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.10\",\"versionEndExcluding\":\"5.10.103\",\"matchCriteriaId\":\"B515B8BE-A929-4F26-A3AE-065750435804\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.26\",\"matchCriteriaId\":\"9AB342AE-A62E-4947-A6EA-511453062B2B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.16.12\",\"matchCriteriaId\":\"C76BAB21-7F23-4AD8-A25F-CA7B262A2698\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/00265efbd3e5705038c9492a434fda8cf960c8a2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/22e9f71072fa605cbf033158db58e0790101928d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5b1cef5798b4fd6e4fd5522e7b8a26248beeacaa\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d350724795c7a48b05bf921d94699fbfecf7da0b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-48925\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T15:33:15.605399Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:15.678Z\"}}], \"cna\": {\"title\": \"RDMA/cma: Do not change route.addr.src_addr outside state checks\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"732d41c545bb\", \"lessThan\": \"5b1cef5798b4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"732d41c545bb\", \"lessThan\": \"00265efbd3e5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"732d41c545bb\", \"lessThan\": \"d350724795c7\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"732d41c545bb\", \"lessThan\": \"22e9f71072fa\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/infiniband/core/cma.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.10\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.10\", \"versionType\": \"custom\"}, {\"status\": \"unaffected\", \"version\": \"5.10.103\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.26\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"5.16.12\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"5.16.*\"}, {\"status\": \"unaffected\", \"version\": \"5.17\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/infiniband/core/cma.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/5b1cef5798b4fd6e4fd5522e7b8a26248beeacaa\"}, {\"url\": \"https://git.kernel.org/stable/c/00265efbd3e5705038c9492a434fda8cf960c8a2\"}, {\"url\": \"https://git.kernel.org/stable/c/d350724795c7a48b05bf921d94699fbfecf7da0b\"}, {\"url\": \"https://git.kernel.org/stable/c/22e9f71072fa605cbf033158db58e0790101928d\"}], \"x_generator\": {\"engine\": \"bippy-c9c4e1df01b2\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nRDMA/cma: Do not change route.addr.src_addr outside state checks\\n\\nIf the state is not idle then resolve_prepare_src() should immediately\\nfail and no change to global state should happen. However, it\\nunconditionally overwrites the src_addr trying to build a temporary any\\naddress.\\n\\nFor instance if the state is already RDMA_CM_LISTEN then this will corrupt\\nthe src_addr and would cause the test in cma_cancel_operation():\\n\\n if (cma_any_addr(cma_src_addr(id_priv)) \u0026\u0026 !id_priv-\u003ecma_dev)\\n\\nWhich would manifest as this trace from syzkaller:\\n\\n BUG: KASAN: use-after-free in __list_add_valid+0x93/0xa0 lib/list_debug.c:26\\n Read of size 8 at addr ffff8881546491e0 by task syz-executor.1/32204\\n\\n CPU: 1 PID: 32204 Comm: syz-executor.1 Not tainted 5.12.0-rc8-syzkaller #0\\n Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\\n Call Trace:\\n __dump_stack lib/dump_stack.c:79 [inline]\\n dump_stack+0x141/0x1d7 lib/dump_stack.c:120\\n print_address_description.constprop.0.cold+0x5b/0x2f8 mm/kasan/report.c:232\\n __kasan_report mm/kasan/report.c:399 [inline]\\n kasan_report.cold+0x7c/0xd8 mm/kasan/report.c:416\\n __list_add_valid+0x93/0xa0 lib/list_debug.c:26\\n __list_add include/linux/list.h:67 [inline]\\n list_add_tail include/linux/list.h:100 [inline]\\n cma_listen_on_all drivers/infiniband/core/cma.c:2557 [inline]\\n rdma_listen+0x787/0xe00 drivers/infiniband/core/cma.c:3751\\n ucma_listen+0x16a/0x210 drivers/infiniband/core/ucma.c:1102\\n ucma_write+0x259/0x350 drivers/infiniband/core/ucma.c:1732\\n vfs_write+0x28e/0xa30 fs/read_write.c:603\\n ksys_write+0x1ee/0x250 fs/read_write.c:658\\n do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46\\n entry_SYSCALL_64_after_hwframe+0x44/0xae\\n\\nThis is indicating that an rdma_id_private was destroyed without doing\\ncma_cancel_listens().\\n\\nInstead of trying to re-use the src_addr memory to indirectly create an\\nany address derived from the dst build one explicitly on the stack and\\nbind to that as any other normal flow would do. rdma_bind_addr() will copy\\nit over the src_addr once it knows the state is valid.\\n\\nThis is similar to commit bc0bdc5afaa7 (\\\"RDMA/cma: Do not change\\nroute.addr.src_addr.ss_family\\\")\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-08-22T03:31:17.323Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2022-48925\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-09-12T17:33:11.068Z\", \"dateReserved\": \"2024-08-21T06:06:23.296Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-08-22T01:33:11.172Z\", \"assignerShortName\": \"Linux\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.