cve-2022-48969
Vulnerability from cvelistv5
Published
2024-10-21 20:05
Modified
2024-12-19 08:11
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: xen-netfront: Fix NULL sring after live migration A NAPI is setup for each network sring to poll data to kernel The sring with source host is destroyed before live migration and new sring with target host is setup after live migration. The NAPI for the old sring is not deleted until setup new sring with target host after migration. With busy_poll/busy_read enabled, the NAPI can be polled before got deleted when resume VM. BUG: unable to handle kernel NULL pointer dereference at 0000000000000008 IP: xennet_poll+0xae/0xd20 PGD 0 P4D 0 Oops: 0000 [#1] SMP PTI Call Trace: finish_task_switch+0x71/0x230 timerqueue_del+0x1d/0x40 hrtimer_try_to_cancel+0xb5/0x110 xennet_alloc_rx_buffers+0x2a0/0x2a0 napi_busy_loop+0xdb/0x270 sock_poll+0x87/0x90 do_sys_poll+0x26f/0x580 tracing_map_insert+0x1d4/0x2f0 event_hist_trigger+0x14a/0x260 finish_task_switch+0x71/0x230 __schedule+0x256/0x890 recalc_sigpending+0x1b/0x50 xen_sched_clock+0x15/0x20 __rb_reserve_next+0x12d/0x140 ring_buffer_lock_reserve+0x123/0x3d0 event_triggers_call+0x87/0xb0 trace_event_buffer_commit+0x1c4/0x210 xen_clocksource_get_cycles+0x15/0x20 ktime_get_ts64+0x51/0xf0 SyS_ppoll+0x160/0x1a0 SyS_ppoll+0x160/0x1a0 do_syscall_64+0x73/0x130 entry_SYSCALL_64_after_hwframe+0x41/0xa6 ... RIP: xennet_poll+0xae/0xd20 RSP: ffffb4f041933900 CR2: 0000000000000008 ---[ end trace f8601785b354351c ]--- xen frontend should remove the NAPIs for the old srings before live migration as the bond srings are destroyed There is a tiny window between the srings are set to NULL and the NAPIs are disabled, It is safe as the NAPI threads are still frozen at that time
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/99859947517e446058ad7243ee81d2f9801fa3ddPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d50b7914fae04d840ce36491d22133070b18cca9Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e6860c889f4ad50b6ab696f5ea154295d72cf27aPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e6e897d4fe2f89c0bd94600a40bedf5e6e75e050Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/ed773dd798bf720756d20021b8d8a4a3d7184bdaPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f2dd60fd3fe98bd36a91b0c6e10bfe9d66258f84Patch
Impacted products
Vendor Product Version
Linux Linux Version: 4ec2411980d0fd2995e8dea8a06fe57aa47523cb
Version: 4ec2411980d0fd2995e8dea8a06fe57aa47523cb
Version: 4ec2411980d0fd2995e8dea8a06fe57aa47523cb
Version: 4ec2411980d0fd2995e8dea8a06fe57aa47523cb
Version: 4ec2411980d0fd2995e8dea8a06fe57aa47523cb
Version: 4ec2411980d0fd2995e8dea8a06fe57aa47523cb
 Create a notification for this product.
   Linux Linux Version: 2.6.24
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-48969",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-22T13:19:22.834399Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-22T13:28:38.112Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/xen-netfront.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "99859947517e446058ad7243ee81d2f9801fa3dd",
              "status": "affected",
              "version": "4ec2411980d0fd2995e8dea8a06fe57aa47523cb",
              "versionType": "git"
            },
            {
              "lessThan": "ed773dd798bf720756d20021b8d8a4a3d7184bda",
              "status": "affected",
              "version": "4ec2411980d0fd2995e8dea8a06fe57aa47523cb",
              "versionType": "git"
            },
            {
              "lessThan": "e6860c889f4ad50b6ab696f5ea154295d72cf27a",
              "status": "affected",
              "version": "4ec2411980d0fd2995e8dea8a06fe57aa47523cb",
              "versionType": "git"
            },
            {
              "lessThan": "e6e897d4fe2f89c0bd94600a40bedf5e6e75e050",
              "status": "affected",
              "version": "4ec2411980d0fd2995e8dea8a06fe57aa47523cb",
              "versionType": "git"
            },
            {
              "lessThan": "f2dd60fd3fe98bd36a91b0c6e10bfe9d66258f84",
              "status": "affected",
              "version": "4ec2411980d0fd2995e8dea8a06fe57aa47523cb",
              "versionType": "git"
            },
            {
              "lessThan": "d50b7914fae04d840ce36491d22133070b18cca9",
              "status": "affected",
              "version": "4ec2411980d0fd2995e8dea8a06fe57aa47523cb",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/xen-netfront.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.24"
            },
            {
              "lessThan": "2.6.24",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.269",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.227",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.159",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.83",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen-netfront: Fix NULL sring after live migration\n\nA NAPI is setup for each network sring to poll data to kernel\nThe sring with source host is destroyed before live migration and\nnew sring with target host is setup after live migration.\nThe NAPI for the old sring is not deleted until setup new sring\nwith target host after migration. With busy_poll/busy_read enabled,\nthe NAPI can be polled before got deleted when resume VM.\n\nBUG: unable to handle kernel NULL pointer dereference at\n0000000000000008\nIP: xennet_poll+0xae/0xd20\nPGD 0 P4D 0\nOops: 0000 [#1] SMP PTI\nCall Trace:\n finish_task_switch+0x71/0x230\n timerqueue_del+0x1d/0x40\n hrtimer_try_to_cancel+0xb5/0x110\n xennet_alloc_rx_buffers+0x2a0/0x2a0\n napi_busy_loop+0xdb/0x270\n sock_poll+0x87/0x90\n do_sys_poll+0x26f/0x580\n tracing_map_insert+0x1d4/0x2f0\n event_hist_trigger+0x14a/0x260\n\n finish_task_switch+0x71/0x230\n __schedule+0x256/0x890\n recalc_sigpending+0x1b/0x50\n xen_sched_clock+0x15/0x20\n __rb_reserve_next+0x12d/0x140\n ring_buffer_lock_reserve+0x123/0x3d0\n event_triggers_call+0x87/0xb0\n trace_event_buffer_commit+0x1c4/0x210\n xen_clocksource_get_cycles+0x15/0x20\n ktime_get_ts64+0x51/0xf0\n SyS_ppoll+0x160/0x1a0\n SyS_ppoll+0x160/0x1a0\n do_syscall_64+0x73/0x130\n entry_SYSCALL_64_after_hwframe+0x41/0xa6\n...\nRIP: xennet_poll+0xae/0xd20 RSP: ffffb4f041933900\nCR2: 0000000000000008\n---[ end trace f8601785b354351c ]---\n\nxen frontend should remove the NAPIs for the old srings before live\nmigration as the bond srings are destroyed\n\nThere is a tiny window between the srings are set to NULL and\nthe NAPIs are disabled, It is safe as the NAPI threads are still\nfrozen at that time"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-19T08:11:35.395Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/99859947517e446058ad7243ee81d2f9801fa3dd"
        },
        {
          "url": "https://git.kernel.org/stable/c/ed773dd798bf720756d20021b8d8a4a3d7184bda"
        },
        {
          "url": "https://git.kernel.org/stable/c/e6860c889f4ad50b6ab696f5ea154295d72cf27a"
        },
        {
          "url": "https://git.kernel.org/stable/c/e6e897d4fe2f89c0bd94600a40bedf5e6e75e050"
        },
        {
          "url": "https://git.kernel.org/stable/c/f2dd60fd3fe98bd36a91b0c6e10bfe9d66258f84"
        },
        {
          "url": "https://git.kernel.org/stable/c/d50b7914fae04d840ce36491d22133070b18cca9"
        }
      ],
      "title": "xen-netfront: Fix NULL sring after live migration",
      "x_generator": {
        "engine": "bippy-5f407fcff5a0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48969",
    "datePublished": "2024-10-21T20:05:51.051Z",
    "dateReserved": "2024-08-22T01:27:53.629Z",
    "dateUpdated": "2024-12-19T08:11:35.395Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-48969\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-10-21T20:15:09.037\",\"lastModified\":\"2024-10-25T21:22:10.087\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nxen-netfront: Fix NULL sring after live migration\\n\\nA NAPI is setup for each network sring to poll data to kernel\\nThe sring with source host is destroyed before live migration and\\nnew sring with target host is setup after live migration.\\nThe NAPI for the old sring is not deleted until setup new sring\\nwith target host after migration. With busy_poll/busy_read enabled,\\nthe NAPI can be polled before got deleted when resume VM.\\n\\nBUG: unable to handle kernel NULL pointer dereference at\\n0000000000000008\\nIP: xennet_poll+0xae/0xd20\\nPGD 0 P4D 0\\nOops: 0000 [#1] SMP PTI\\nCall Trace:\\n finish_task_switch+0x71/0x230\\n timerqueue_del+0x1d/0x40\\n hrtimer_try_to_cancel+0xb5/0x110\\n xennet_alloc_rx_buffers+0x2a0/0x2a0\\n napi_busy_loop+0xdb/0x270\\n sock_poll+0x87/0x90\\n do_sys_poll+0x26f/0x580\\n tracing_map_insert+0x1d4/0x2f0\\n event_hist_trigger+0x14a/0x260\\n\\n finish_task_switch+0x71/0x230\\n __schedule+0x256/0x890\\n recalc_sigpending+0x1b/0x50\\n xen_sched_clock+0x15/0x20\\n __rb_reserve_next+0x12d/0x140\\n ring_buffer_lock_reserve+0x123/0x3d0\\n event_triggers_call+0x87/0xb0\\n trace_event_buffer_commit+0x1c4/0x210\\n xen_clocksource_get_cycles+0x15/0x20\\n ktime_get_ts64+0x51/0xf0\\n SyS_ppoll+0x160/0x1a0\\n SyS_ppoll+0x160/0x1a0\\n do_syscall_64+0x73/0x130\\n entry_SYSCALL_64_after_hwframe+0x41/0xa6\\n...\\nRIP: xennet_poll+0xae/0xd20 RSP: ffffb4f041933900\\nCR2: 0000000000000008\\n---[ end trace f8601785b354351c ]---\\n\\nxen frontend should remove the NAPIs for the old srings before live\\nmigration as the bond srings are destroyed\\n\\nThere is a tiny window between the srings are set to NULL and\\nthe NAPIs are disabled, It is safe as the NAPI threads are still\\nfrozen at that time\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: xen-netfront: Reparar sring NULL despu\u00e9s de la migraci\u00f3n en vivo Se configura un NAPI para cada sring de red para sondear los datos al kernel El sring con el host de origen se destruye antes de la migraci\u00f3n en vivo y se configura el nuevo sring con el host de destino despu\u00e9s de la migraci\u00f3n en vivo. El NAPI para el sring antiguo no se elimina hasta que se configura el nuevo sring con el host de destino despu\u00e9s de la migraci\u00f3n. Con busy_poll/busy_read habilitado, el NAPI se puede sondear antes de que se elimine cuando se reanuda la VM. ERROR: no se puede manejar la desreferencia del puntero NULL del n\u00facleo en 0000000000000008 IP: xennet_poll+0xae/0xd20 PGD 0 P4D 0 Oops: 0000 [#1] Seguimiento de llamadas PTI de SMP: finish_task_switch+0x71/0x230 timerqueue_del+0x1d/0x40 hrtimer_try_to_cancel+0xb5/0x110 xennet_alloc_rx_buffers+0x2a0/0x2a0 napi_busy_loop+0xdb/0x270 sock_poll+0x87/0x90 do_sys_poll+0x26f/0x580 tracing_map_insert+0x1d4/0x2f0 evento_hist_trigger+0x14a/0x260 finalizar_cambio_tarea+0x71/0x230 __schedule+0x256/0x890 recalc_sigping+0x1b/0x50 xen_sched_clock+0x15/0x20 __rb_reserve_next+0x12d/0x140 reserva_bloqueo_buffer_anillo+0x123/0x3d0 llamada_activadores_evento+0x87/0xb0 confirmaci\u00f3n_buffer_evento_trace+0x1c4/0x210 xen_clocksource_get_cycles+0x15/0x20 ktime_get_ts64+0x51/0xf0 SyS_ppoll+0x160/0x1a0 SyS_ppoll+0x160/0x1a0 do_syscall_64+0x73/0x130 entry_SYSCALL_64_after_hwframe+0x41/0xa6 ... RIP: xennet_poll+0xae/0xd20 RSP: ffffb4f041933900 CR2: 0000000000000008 ---[ fin del seguimiento f8601785b354351c ]--- la interfaz de xen debe eliminar las NAPI de los antiguos srings antes de la migraci\u00f3n en vivo, ya que los srings de enlace se destruyen. Hay una peque\u00f1a ventana entre los srings que se establecen en NULL y los NAPI que se deshabilitan. Es seguro ya que los subprocesos NAPI todav\u00eda est\u00e1n congelados en ese momento.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.24\",\"versionEndExcluding\":\"4.19.269\",\"matchCriteriaId\":\"15C7931B-DA37-4374-B1A0-AE4E0F69FB92\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.227\",\"matchCriteriaId\":\"8C752145-904B-474A-A7F2-E9F29353B0FE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.159\",\"matchCriteriaId\":\"7318B597-DFFD-4BBC-A947-539D6E30D82A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.83\",\"matchCriteriaId\":\"90897BD1-104D-4CFF-94F5-29F9041217FB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.0.13\",\"matchCriteriaId\":\"389392A7-81C4-4C26-884B-8C7CF0F53DA4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"E7E331DA-1FB0-4DEC-91AC-7DA69D461C11\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"17F0B248-42CF-4AE6-A469-BB1BAE7F4705\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"E2422816-0C14-4B5E-A1E6-A9D776E5C49B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"1C6E00FE-5FB9-4D20-A1A1-5A32128F9B76\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"35B26BE4-43A6-4A36-A7F6-5B3F572D9186\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"3FFFB0B3-930D-408A-91E2-BAE0C2715D80\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"8535320E-A0DB-4277-800E-D0CE5BBA59E8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc8:*:*:*:*:*:*\",\"matchCriteriaId\":\"21718AA4-4056-40F2-968E-BDAA465A7872\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/99859947517e446058ad7243ee81d2f9801fa3dd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d50b7914fae04d840ce36491d22133070b18cca9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e6860c889f4ad50b6ab696f5ea154295d72cf27a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e6e897d4fe2f89c0bd94600a40bedf5e6e75e050\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ed773dd798bf720756d20021b8d8a4a3d7184bda\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f2dd60fd3fe98bd36a91b0c6e10bfe9d66258f84\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-48969\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-22T13:19:22.834399Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-22T13:19:25.869Z\"}}], \"cna\": {\"title\": \"xen-netfront: Fix NULL sring after live migration\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4ec2411980d0fd2995e8dea8a06fe57aa47523cb\", \"lessThan\": \"99859947517e446058ad7243ee81d2f9801fa3dd\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4ec2411980d0fd2995e8dea8a06fe57aa47523cb\", \"lessThan\": \"ed773dd798bf720756d20021b8d8a4a3d7184bda\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4ec2411980d0fd2995e8dea8a06fe57aa47523cb\", \"lessThan\": \"e6860c889f4ad50b6ab696f5ea154295d72cf27a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4ec2411980d0fd2995e8dea8a06fe57aa47523cb\", \"lessThan\": \"e6e897d4fe2f89c0bd94600a40bedf5e6e75e050\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4ec2411980d0fd2995e8dea8a06fe57aa47523cb\", \"lessThan\": \"f2dd60fd3fe98bd36a91b0c6e10bfe9d66258f84\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4ec2411980d0fd2995e8dea8a06fe57aa47523cb\", \"lessThan\": \"d50b7914fae04d840ce36491d22133070b18cca9\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/xen-netfront.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.24\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.24\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.269\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.227\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.159\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.83\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.0.13\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.0.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/xen-netfront.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/99859947517e446058ad7243ee81d2f9801fa3dd\"}, {\"url\": \"https://git.kernel.org/stable/c/ed773dd798bf720756d20021b8d8a4a3d7184bda\"}, {\"url\": \"https://git.kernel.org/stable/c/e6860c889f4ad50b6ab696f5ea154295d72cf27a\"}, {\"url\": \"https://git.kernel.org/stable/c/e6e897d4fe2f89c0bd94600a40bedf5e6e75e050\"}, {\"url\": \"https://git.kernel.org/stable/c/f2dd60fd3fe98bd36a91b0c6e10bfe9d66258f84\"}, {\"url\": \"https://git.kernel.org/stable/c/d50b7914fae04d840ce36491d22133070b18cca9\"}], \"x_generator\": {\"engine\": \"bippy-5f407fcff5a0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nxen-netfront: Fix NULL sring after live migration\\n\\nA NAPI is setup for each network sring to poll data to kernel\\nThe sring with source host is destroyed before live migration and\\nnew sring with target host is setup after live migration.\\nThe NAPI for the old sring is not deleted until setup new sring\\nwith target host after migration. With busy_poll/busy_read enabled,\\nthe NAPI can be polled before got deleted when resume VM.\\n\\nBUG: unable to handle kernel NULL pointer dereference at\\n0000000000000008\\nIP: xennet_poll+0xae/0xd20\\nPGD 0 P4D 0\\nOops: 0000 [#1] SMP PTI\\nCall Trace:\\n finish_task_switch+0x71/0x230\\n timerqueue_del+0x1d/0x40\\n hrtimer_try_to_cancel+0xb5/0x110\\n xennet_alloc_rx_buffers+0x2a0/0x2a0\\n napi_busy_loop+0xdb/0x270\\n sock_poll+0x87/0x90\\n do_sys_poll+0x26f/0x580\\n tracing_map_insert+0x1d4/0x2f0\\n event_hist_trigger+0x14a/0x260\\n\\n finish_task_switch+0x71/0x230\\n __schedule+0x256/0x890\\n recalc_sigpending+0x1b/0x50\\n xen_sched_clock+0x15/0x20\\n __rb_reserve_next+0x12d/0x140\\n ring_buffer_lock_reserve+0x123/0x3d0\\n event_triggers_call+0x87/0xb0\\n trace_event_buffer_commit+0x1c4/0x210\\n xen_clocksource_get_cycles+0x15/0x20\\n ktime_get_ts64+0x51/0xf0\\n SyS_ppoll+0x160/0x1a0\\n SyS_ppoll+0x160/0x1a0\\n do_syscall_64+0x73/0x130\\n entry_SYSCALL_64_after_hwframe+0x41/0xa6\\n...\\nRIP: xennet_poll+0xae/0xd20 RSP: ffffb4f041933900\\nCR2: 0000000000000008\\n---[ end trace f8601785b354351c ]---\\n\\nxen frontend should remove the NAPIs for the old srings before live\\nmigration as the bond srings are destroyed\\n\\nThere is a tiny window between the srings are set to NULL and\\nthe NAPIs are disabled, It is safe as the NAPI threads are still\\nfrozen at that time\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-12-19T08:11:35.395Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-48969\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-12-19T08:11:35.395Z\", \"dateReserved\": \"2024-08-22T01:27:53.629Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T20:05:51.051Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.