cve-2022-48983
Vulnerability from cvelistv5
Published
2024-10-21 20:06
Modified
2024-12-19 08:11
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: io_uring: Fix a null-ptr-deref in io_tctx_exit_cb() Syzkaller reports a NULL deref bug as follows: BUG: KASAN: null-ptr-deref in io_tctx_exit_cb+0x53/0xd3 Read of size 4 at addr 0000000000000138 by task file1/1955 CPU: 1 PID: 1955 Comm: file1 Not tainted 6.1.0-rc7-00103-gef4d3ea40565 #75 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0xcd/0x134 ? io_tctx_exit_cb+0x53/0xd3 kasan_report+0xbb/0x1f0 ? io_tctx_exit_cb+0x53/0xd3 kasan_check_range+0x140/0x190 io_tctx_exit_cb+0x53/0xd3 task_work_run+0x164/0x250 ? task_work_cancel+0x30/0x30 get_signal+0x1c3/0x2440 ? lock_downgrade+0x6e0/0x6e0 ? lock_downgrade+0x6e0/0x6e0 ? exit_signals+0x8b0/0x8b0 ? do_raw_read_unlock+0x3b/0x70 ? do_raw_spin_unlock+0x50/0x230 arch_do_signal_or_restart+0x82/0x2470 ? kmem_cache_free+0x260/0x4b0 ? putname+0xfe/0x140 ? get_sigframe_size+0x10/0x10 ? do_execveat_common.isra.0+0x226/0x710 ? lockdep_hardirqs_on+0x79/0x100 ? putname+0xfe/0x140 ? do_execveat_common.isra.0+0x238/0x710 exit_to_user_mode_prepare+0x15f/0x250 syscall_exit_to_user_mode+0x19/0x50 do_syscall_64+0x42/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0023:0x0 Code: Unable to access opcode bytes at 0xffffffffffffffd6. RSP: 002b:00000000fffb7790 EFLAGS: 00000200 ORIG_RAX: 000000000000000b RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 </TASK> Kernel panic - not syncing: panic_on_warn set ... This happens because the adding of task_work from io_ring_exit_work() isn't synchronized with canceling all work items from eg exec. The execution of the two are ordered in that they are both run by the task itself, but if io_tctx_exit_cb() is queued while we're canceling all work items off exec AND gets executed when the task exits to userspace rather than in the main loop in io_uring_cancel_generic(), then we can find current->io_uring == NULL and hit the above crash. It's safe to add this NULL check here, because the execution of the two paths are done by the task itself. [axboe: add code comment and also put an explanation in the commit msg]
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/998b30c3948e4d0b1097e639918c5cff332acac5Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d91edca1943453aaaba4f380f6f364346222e5cfPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f895511de9d27fff71dad2c234ad53b4afd2b06cPatch
Impacted products
Vendor Product Version
Linux Linux Version: d56d938b4bef3e1421a42023cdcd6e13c1f50831
Version: d56d938b4bef3e1421a42023cdcd6e13c1f50831
Version: d56d938b4bef3e1421a42023cdcd6e13c1f50831
 Create a notification for this product.
   Linux Linux Version: 5.12
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-48983",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-10-22T13:17:35.242008Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-10-22T13:18:43.423Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "Linux",
               programFiles: [
                  "io_uring/io_uring.c",
               ],
               repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               vendor: "Linux",
               versions: [
                  {
                     lessThan: "f895511de9d27fff71dad2c234ad53b4afd2b06c",
                     status: "affected",
                     version: "d56d938b4bef3e1421a42023cdcd6e13c1f50831",
                     versionType: "git",
                  },
                  {
                     lessThan: "d91edca1943453aaaba4f380f6f364346222e5cf",
                     status: "affected",
                     version: "d56d938b4bef3e1421a42023cdcd6e13c1f50831",
                     versionType: "git",
                  },
                  {
                     lessThan: "998b30c3948e4d0b1097e639918c5cff332acac5",
                     status: "affected",
                     version: "d56d938b4bef3e1421a42023cdcd6e13c1f50831",
                     versionType: "git",
                  },
               ],
            },
            {
               defaultStatus: "affected",
               product: "Linux",
               programFiles: [
                  "io_uring/io_uring.c",
               ],
               repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               vendor: "Linux",
               versions: [
                  {
                     status: "affected",
                     version: "5.12",
                  },
                  {
                     lessThan: "5.12",
                     status: "unaffected",
                     version: "0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "5.15.*",
                     status: "unaffected",
                     version: "5.15.83",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "6.0.*",
                     status: "unaffected",
                     version: "6.0.13",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "*",
                     status: "unaffected",
                     version: "6.1",
                     versionType: "original_commit_for_fix",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring: Fix a null-ptr-deref in io_tctx_exit_cb()\n\nSyzkaller reports a NULL deref bug as follows:\n\n BUG: KASAN: null-ptr-deref in io_tctx_exit_cb+0x53/0xd3\n Read of size 4 at addr 0000000000000138 by task file1/1955\n\n CPU: 1 PID: 1955 Comm: file1 Not tainted 6.1.0-rc7-00103-gef4d3ea40565 #75\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014\n Call Trace:\n  <TASK>\n  dump_stack_lvl+0xcd/0x134\n  ? io_tctx_exit_cb+0x53/0xd3\n  kasan_report+0xbb/0x1f0\n  ? io_tctx_exit_cb+0x53/0xd3\n  kasan_check_range+0x140/0x190\n  io_tctx_exit_cb+0x53/0xd3\n  task_work_run+0x164/0x250\n  ? task_work_cancel+0x30/0x30\n  get_signal+0x1c3/0x2440\n  ? lock_downgrade+0x6e0/0x6e0\n  ? lock_downgrade+0x6e0/0x6e0\n  ? exit_signals+0x8b0/0x8b0\n  ? do_raw_read_unlock+0x3b/0x70\n  ? do_raw_spin_unlock+0x50/0x230\n  arch_do_signal_or_restart+0x82/0x2470\n  ? kmem_cache_free+0x260/0x4b0\n  ? putname+0xfe/0x140\n  ? get_sigframe_size+0x10/0x10\n  ? do_execveat_common.isra.0+0x226/0x710\n  ? lockdep_hardirqs_on+0x79/0x100\n  ? putname+0xfe/0x140\n  ? do_execveat_common.isra.0+0x238/0x710\n  exit_to_user_mode_prepare+0x15f/0x250\n  syscall_exit_to_user_mode+0x19/0x50\n  do_syscall_64+0x42/0xb0\n  entry_SYSCALL_64_after_hwframe+0x63/0xcd\n RIP: 0023:0x0\n Code: Unable to access opcode bytes at 0xffffffffffffffd6.\n RSP: 002b:00000000fffb7790 EFLAGS: 00000200 ORIG_RAX: 000000000000000b\n RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000\n RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\n RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000\n R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\n  </TASK>\n Kernel panic - not syncing: panic_on_warn set ...\n\nThis happens because the adding of task_work from io_ring_exit_work()\nisn't synchronized with canceling all work items from eg exec. The\nexecution of the two are ordered in that they are both run by the task\nitself, but if io_tctx_exit_cb() is queued while we're canceling all\nwork items off exec AND gets executed when the task exits to userspace\nrather than in the main loop in io_uring_cancel_generic(), then we can\nfind current->io_uring == NULL and hit the above crash.\n\nIt's safe to add this NULL check here, because the execution of the two\npaths are done by the task itself.\n\n[axboe: add code comment and also put an explanation in the commit msg]",
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-12-19T08:11:53.174Z",
            orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            shortName: "Linux",
         },
         references: [
            {
               url: "https://git.kernel.org/stable/c/f895511de9d27fff71dad2c234ad53b4afd2b06c",
            },
            {
               url: "https://git.kernel.org/stable/c/d91edca1943453aaaba4f380f6f364346222e5cf",
            },
            {
               url: "https://git.kernel.org/stable/c/998b30c3948e4d0b1097e639918c5cff332acac5",
            },
         ],
         title: "io_uring: Fix a null-ptr-deref in io_tctx_exit_cb()",
         x_generator: {
            engine: "bippy-5f407fcff5a0",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      assignerShortName: "Linux",
      cveId: "CVE-2022-48983",
      datePublished: "2024-10-21T20:06:00.376Z",
      dateReserved: "2024-08-22T01:27:53.633Z",
      dateUpdated: "2024-12-19T08:11:53.174Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      nvd: "{\"cve\":{\"id\":\"CVE-2022-48983\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-10-21T20:15:10.283\",\"lastModified\":\"2024-10-25T15:58:02.297\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nio_uring: Fix a null-ptr-deref in io_tctx_exit_cb()\\n\\nSyzkaller reports a NULL deref bug as follows:\\n\\n BUG: KASAN: null-ptr-deref in io_tctx_exit_cb+0x53/0xd3\\n Read of size 4 at addr 0000000000000138 by task file1/1955\\n\\n CPU: 1 PID: 1955 Comm: file1 Not tainted 6.1.0-rc7-00103-gef4d3ea40565 #75\\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014\\n Call Trace:\\n  <TASK>\\n  dump_stack_lvl+0xcd/0x134\\n  ? io_tctx_exit_cb+0x53/0xd3\\n  kasan_report+0xbb/0x1f0\\n  ? io_tctx_exit_cb+0x53/0xd3\\n  kasan_check_range+0x140/0x190\\n  io_tctx_exit_cb+0x53/0xd3\\n  task_work_run+0x164/0x250\\n  ? task_work_cancel+0x30/0x30\\n  get_signal+0x1c3/0x2440\\n  ? lock_downgrade+0x6e0/0x6e0\\n  ? lock_downgrade+0x6e0/0x6e0\\n  ? exit_signals+0x8b0/0x8b0\\n  ? do_raw_read_unlock+0x3b/0x70\\n  ? do_raw_spin_unlock+0x50/0x230\\n  arch_do_signal_or_restart+0x82/0x2470\\n  ? kmem_cache_free+0x260/0x4b0\\n  ? putname+0xfe/0x140\\n  ? get_sigframe_size+0x10/0x10\\n  ? do_execveat_common.isra.0+0x226/0x710\\n  ? lockdep_hardirqs_on+0x79/0x100\\n  ? putname+0xfe/0x140\\n  ? do_execveat_common.isra.0+0x238/0x710\\n  exit_to_user_mode_prepare+0x15f/0x250\\n  syscall_exit_to_user_mode+0x19/0x50\\n  do_syscall_64+0x42/0xb0\\n  entry_SYSCALL_64_after_hwframe+0x63/0xcd\\n RIP: 0023:0x0\\n Code: Unable to access opcode bytes at 0xffffffffffffffd6.\\n RSP: 002b:00000000fffb7790 EFLAGS: 00000200 ORIG_RAX: 000000000000000b\\n RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000\\n RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\\n RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000\\n R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000\\n R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\\n  </TASK>\\n Kernel panic - not syncing: panic_on_warn set ...\\n\\nThis happens because the adding of task_work from io_ring_exit_work()\\nisn't synchronized with canceling all work items from eg exec. The\\nexecution of the two are ordered in that they are both run by the task\\nitself, but if io_tctx_exit_cb() is queued while we're canceling all\\nwork items off exec AND gets executed when the task exits to userspace\\nrather than in the main loop in io_uring_cancel_generic(), then we can\\nfind current->io_uring == NULL and hit the above crash.\\n\\nIt's safe to add this NULL check here, because the execution of the two\\npaths are done by the task itself.\\n\\n[axboe: add code comment and also put an explanation in the commit msg]\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: io_uring: Se corrige un null-ptr-deref en io_tctx_exit_cb() Syzkaller informa un error de desreferencia NULL de la siguiente manera: ERROR: KASAN: null-ptr-deref en io_tctx_exit_cb+0x53/0xd3 Lectura de tamaño 4 en la dirección 0000000000000138 por la tarea file1/1955 CPU: 1 PID: 1955 Comm: file1 No contaminado 6.1.0-rc7-00103-gef4d3ea40565 #75 Nombre del hardware: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014 Seguimiento de llamadas:  nivel_pila_volcado+0xcd/0x134 ? io_tctx_salir_cb+0x53/0xd3 informe_kasan+0xbb/0x1f0 ? io_tctx_salir_cb+0x53/0xd3 rango_comprobación_kasan+0x140/0x190 io_tctx_salir_cb+0x53/0xd3 ejecución_trabajo_tarea+0x164/0x250 ? cancelación_trabajo_tarea+0x30/0x30 obtener_señal+0x1c3/0x2440 ? degradación_bloqueo+0x6e0/0x6e0 ? degradación_bloqueo+0x6e0/0x6e0 ? señales_salida+0x8b0/0x8b0 ? desbloqueo_lectura_sin_datos+0x3b/0x70 ? obtener_sigframe_size+0x10/0x10 ? bloquear_hardirqs_on+0x79/0x100 ? poner_nombre+0xfe/0x140 ? do_execveat_common.isra.0+0x238/0x710 exit_to_user_mode_prepare+0x15f/0x250 syscall_exit_to_user_mode+0x19/0x50 do_syscall_64+0x42/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0023:0x0 Código: No se puede acceder a los bytes del código de operación en 0xffffffffffffffd6. RSP: 002b:00000000fffb7790 EFLAGS: 00000200 ORIG_RAX: 000000000000000b RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 000000000000000 RDI: 000000000000000 RBP: 000000000000000 R08: 0000000000000000 R09: 00000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000  Pánico del kernel: no se sincroniza: panic_on_warn establecido ... Esto sucede porque la adición de task_work desde io_ring_exit_work() no está sincronizada con la cancelación de todos los elementos de trabajo, por ejemplo, de exec. La ejecución de los dos está ordenada de manera que ambos son ejecutados por la propia tarea, pero si io_tctx_exit_cb() está en cola mientras cancelamos todos los elementos de trabajo de exec Y se ejecuta cuando la tarea sale al espacio de usuario en lugar de en el bucle principal en io_uring_cancel_generic(), entonces podemos encontrar current-&gt;io_uring == NULL y alcanzar el bloqueo anterior. Es seguro agregar esta verificación NULL aquí, porque la ejecución de las dos rutas las realiza la propia tarea. [axboe: agregue un comentario de código y también coloque una explicación en el mensaje de confirmación]\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.12\",\"versionEndExcluding\":\"5.15.83\",\"matchCriteriaId\":\"F3B523BF-F3E1-45F6-8064-D51E4E6D05E7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.0.13\",\"matchCriteriaId\":\"389392A7-81C4-4C26-884B-8C7CF0F53DA4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"E7E331DA-1FB0-4DEC-91AC-7DA69D461C11\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"17F0B248-42CF-4AE6-A469-BB1BAE7F4705\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"E2422816-0C14-4B5E-A1E6-A9D776E5C49B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"1C6E00FE-5FB9-4D20-A1A1-5A32128F9B76\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"35B26BE4-43A6-4A36-A7F6-5B3F572D9186\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"3FFFB0B3-930D-408A-91E2-BAE0C2715D80\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"8535320E-A0DB-4277-800E-D0CE5BBA59E8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc8:*:*:*:*:*:*\",\"matchCriteriaId\":\"21718AA4-4056-40F2-968E-BDAA465A7872\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/998b30c3948e4d0b1097e639918c5cff332acac5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d91edca1943453aaaba4f380f6f364346222e5cf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f895511de9d27fff71dad2c234ad53b4afd2b06c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
      vulnrichment: {
         containers: "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-48983\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-22T13:17:35.242008Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-22T13:17:38.765Z\"}}], \"cna\": {\"title\": \"io_uring: Fix a null-ptr-deref in io_tctx_exit_cb()\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"d56d938b4bef3e1421a42023cdcd6e13c1f50831\", \"lessThan\": \"f895511de9d27fff71dad2c234ad53b4afd2b06c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d56d938b4bef3e1421a42023cdcd6e13c1f50831\", \"lessThan\": \"d91edca1943453aaaba4f380f6f364346222e5cf\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d56d938b4bef3e1421a42023cdcd6e13c1f50831\", \"lessThan\": \"998b30c3948e4d0b1097e639918c5cff332acac5\", \"versionType\": \"git\"}], \"programFiles\": [\"io_uring/io_uring.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.12\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.12\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.83\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.0.13\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.0.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"io_uring/io_uring.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/f895511de9d27fff71dad2c234ad53b4afd2b06c\"}, {\"url\": \"https://git.kernel.org/stable/c/d91edca1943453aaaba4f380f6f364346222e5cf\"}, {\"url\": \"https://git.kernel.org/stable/c/998b30c3948e4d0b1097e639918c5cff332acac5\"}], \"x_generator\": {\"engine\": \"bippy-5f407fcff5a0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nio_uring: Fix a null-ptr-deref in io_tctx_exit_cb()\\n\\nSyzkaller reports a NULL deref bug as follows:\\n\\n BUG: KASAN: null-ptr-deref in io_tctx_exit_cb+0x53/0xd3\\n Read of size 4 at addr 0000000000000138 by task file1/1955\\n\\n CPU: 1 PID: 1955 Comm: file1 Not tainted 6.1.0-rc7-00103-gef4d3ea40565 #75\\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014\\n Call Trace:\\n  <TASK>\\n  dump_stack_lvl+0xcd/0x134\\n  ? io_tctx_exit_cb+0x53/0xd3\\n  kasan_report+0xbb/0x1f0\\n  ? io_tctx_exit_cb+0x53/0xd3\\n  kasan_check_range+0x140/0x190\\n  io_tctx_exit_cb+0x53/0xd3\\n  task_work_run+0x164/0x250\\n  ? task_work_cancel+0x30/0x30\\n  get_signal+0x1c3/0x2440\\n  ? lock_downgrade+0x6e0/0x6e0\\n  ? lock_downgrade+0x6e0/0x6e0\\n  ? exit_signals+0x8b0/0x8b0\\n  ? do_raw_read_unlock+0x3b/0x70\\n  ? do_raw_spin_unlock+0x50/0x230\\n  arch_do_signal_or_restart+0x82/0x2470\\n  ? kmem_cache_free+0x260/0x4b0\\n  ? putname+0xfe/0x140\\n  ? get_sigframe_size+0x10/0x10\\n  ? do_execveat_common.isra.0+0x226/0x710\\n  ? lockdep_hardirqs_on+0x79/0x100\\n  ? putname+0xfe/0x140\\n  ? do_execveat_common.isra.0+0x238/0x710\\n  exit_to_user_mode_prepare+0x15f/0x250\\n  syscall_exit_to_user_mode+0x19/0x50\\n  do_syscall_64+0x42/0xb0\\n  entry_SYSCALL_64_after_hwframe+0x63/0xcd\\n RIP: 0023:0x0\\n Code: Unable to access opcode bytes at 0xffffffffffffffd6.\\n RSP: 002b:00000000fffb7790 EFLAGS: 00000200 ORIG_RAX: 000000000000000b\\n RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000\\n RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\\n RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000\\n R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000\\n R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\\n  </TASK>\\n Kernel panic - not syncing: panic_on_warn set ...\\n\\nThis happens because the adding of task_work from io_ring_exit_work()\\nisn't synchronized with canceling all work items from eg exec. The\\nexecution of the two are ordered in that they are both run by the task\\nitself, but if io_tctx_exit_cb() is queued while we're canceling all\\nwork items off exec AND gets executed when the task exits to userspace\\nrather than in the main loop in io_uring_cancel_generic(), then we can\\nfind current->io_uring == NULL and hit the above crash.\\n\\nIt's safe to add this NULL check here, because the execution of the two\\npaths are done by the task itself.\\n\\n[axboe: add code comment and also put an explanation in the commit msg]\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-12-19T08:11:53.174Z\"}}}",
         cveMetadata: "{\"cveId\": \"CVE-2022-48983\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-12-19T08:11:53.174Z\", \"dateReserved\": \"2024-08-22T01:27:53.633Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T20:06:00.376Z\", \"assignerShortName\": \"Linux\"}",
         dataType: "CVE_RECORD",
         dataVersion: "5.1",
      },
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.