Log in Start free

Vulnerability · Published Apr 28, 2024 · Assigned by Linux

CVE-2022-48666scsi: core: Fix a use-after-free

Critical 9.8

In plain English

A critical-severity use-after-free in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.8%top 44.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix a use-after-free There are two .exit_cmd_priv implementations. Both implementations use resources associated with the SCSI host. Make sure that these resources are still available when .exit_cmd_priv is called by waiting inside scsi_remove_host() until the tag set has been freed. This commit fixes the following use-after-free: ================================================================== BUG: KASAN: use-after-free in srp_exit_cmd_priv+0x27/0xd0 [ib_srp] Read of size 8 at addr ffff888100337000 by task multipathd/16727 Call Trace: <TASK> dump_stack_lvl+0x34/0x44 print_report.cold+0x5e/0x5db kasan_report+0xab/0x120 srp_exit_cmd_priv+0x27/0xd0 [ib_srp] scsi_mq_exit_request+0x4d/0x70 blk_mq_free_rqs+0x143/0x410 __blk_mq_free_map_and_rqs+0x6e/0x100 blk_mq_free_tag_set+0x2b/0x160 scsi_host_dev_release+0xf3/0x1a0 device_release+0x54/0xe0 kobject_put+0xa5/0x120 device_release+0x54/0xe0 kobject_put+0xa5/0x120 scsi_device_dev_release_usercontext+0x4c1/0x4e0 execute_in_process_context+0x23/0x90 device_release+0x54/0xe0 kobject_put+0xa5/0x120 scsi_disk_release+0x3f/0x50 device_release+0x54/0xe0 kobject_put+0xa5/0x120 disk_release+0x17f/0x1b0 device_release+0x54/0xe0 kobject_put+0xa5/0x120 dm_put_table_device+0xa3/0x160 [dm_mod] dm_put_device+0xd0/0x140 [dm_mod] free_priority_group+0xd8/0x110 [dm_multipath] free_multipath+0x94/0xe0 [dm_multipath] dm_table_destroy+0xa2/0x1e0 [dm_mod] __dm_destroy+0x196/0x350 [dm_mod] dev_remove+0x10c/0x160 [dm_mod] ctl_ioctl+0x2c2/0x590 [dm_mod] dm_ctl_ioctl+0x5/0x10 [dm_mod] __x64_sys_ioctl+0xb4/0xf0 dm_ctl_ioctl+0x5/0x10 [dm_mod] __x64_sys_ioctl+0xb4/0xf0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x46/0xb0

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.0.2-1DEBIAN-CVE-2022-48666
Debian:13linux6.0.2-1DEBIAN-CVE-2022-48666
Debian:14linux6.0.2-1DEBIAN-CVE-2022-48666
Ubuntu:22.04:LTSlinux5.15.0-125.135UBUNTU-CVE-2022-48666
Ubuntu:22.04:LTSlinux5.15.0-125.135USN-7100-1
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2022-48666
Ubuntu:22.04:LTSlinux-aws5.15.0-1072.78USN-7100-2
Ubuntu:22.04:LTSlinux-aws5.15.0-1072.78UBUNTU-CVE-2022-48666
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2022-48666
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2022-48666
Ubuntu:22.04:LTSlinux-azure5.15.0-1075.84UBUNTU-CVE-2022-48666
Ubuntu:22.04:LTSlinux-azure5.15.0-1075.84USN-7123-1
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2022-48666
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2022-48666
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1076.85.1UBUNTU-CVE-2022-48666
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2022-48666
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2022-48666
Ubuntu:22.04:LTSlinux-gcp5.15.0-1071.79UBUNTU-CVE-2022-48666
Ubuntu:22.04:LTSlinux-gcp5.15.0-1071.79USN-7100-1
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2022-48666
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2022-48666
Ubuntu:22.04:LTSlinux-gke5.15.0-1069.75UBUNTU-CVE-2022-48666
Ubuntu:22.04:LTSlinux-gke5.15.0-1069.75USN-7100-1
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1055.62USN-7100-1
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1055.62UBUNTU-CVE-2022-48666
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2022-48666
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2022-48666
Ubuntu:22.04:LTSlinux-ibm5.15.0-1065.68UBUNTU-CVE-2022-48666
Ubuntu:22.04:LTSlinux-ibm5.15.0-1065.68USN-7100-1
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1067.73UBUNTU-CVE-2022-48666
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1067.73USN-7144-1
Ubuntu:22.04:LTSlinux-kvm5.15.0-1069.74USN-7100-1
Ubuntu:22.04:LTSlinux-kvm5.15.0-1069.74UBUNTU-CVE-2022-48666
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-125.135UBUNTU-CVE-2022-48666
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-125.135USN-7100-1
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2022-48666
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2022-48666
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1067.68USN-7100-1
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1067.68UBUNTU-CVE-2022-48666
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2022-48666
Ubuntu:22.04:LTSlinux-nvidia-tegra5.15.0-1032.32UBUNTU-CVE-2022-48666
Ubuntu:22.04:LTSlinux-nvidia-tegra-igx5.15.0-1020.20UBUNTU-CVE-2022-48666
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2022-48666
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2022-48666
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2022-48666
Ubuntu:22.04:LTSlinux-oracle5.15.0-1070.76USN-7100-1
Ubuntu:22.04:LTSlinux-oracle5.15.0-1070.76UBUNTU-CVE-2022-48666
Ubuntu:22.04:LTSlinux-raspi5.15.0-1065.68USN-7100-1
Ubuntu:22.04:LTSlinux-raspi5.15.0-1065.68UBUNTU-CVE-2022-48666
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2022-48666
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2022-48666
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2022-48666
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2022-48666
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2022-48666
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2022-48666
Ubuntu:22.04:LTSlinux-xilinx-zynqmp5.15.0-1038.42UBUNTU-CVE-2022-48666
Ubuntu:22.04:LTSlinux-xilinx-zynqmp5.15.0-1038.42USN-7100-1

Affected products (as reported)

VendorProductVersions
Linux Linux 65ca846a53149a1a72cd8d02e7b2e73dd545b834 – before 5ce8fad941233e81f2afb5b52a3fcddd3ba8732f65ca846a53149a1a72cd8d02e7b2e73dd545b834 – before f818708eeeae793e12dc39f8984ed7732048a7d965ca846a53149a1a72cd8d02e7b2e73dd545b834 – before 2e7eb4c1e8af8385de22775bd0be552f59b28c9a65ca846a53149a1a72cd8d02e7b2e73dd545b834 – before 8fe4ce5836e932f5766317cb651c1ff2a4cd0506
Linux Linux 5.7

Weakness: CWE-416 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References