Log in Start free

Vulnerability · Published Oct 21, 2024 · Assigned by Linux

CVE-2022-48986mm/gup: fix gup_pud_range() for dax

High 7.8

In plain English

A high-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.3%top 82.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: mm/gup: fix gup_pud_range() for dax For dax pud, pud_huge() returns true on x86. So the function works as long as hugetlb is configured. However, dax doesn't depend on hugetlb. Commit 414fd080d125 ("mm/gup: fix gup_pmd_range() for dax") fixed devmap-backed huge PMDs, but missed devmap-backed huge PUDs. Fix this as well. This fixes the below kernel panic: general protection fault, probably for non-canonical address 0x69e7c000cc478: 0000 [#1] SMP < snip > Call Trace: <TASK> get_user_pages_fast+0x1f/0x40 iov_iter_get_pages+0xc6/0x3b0 ? mempool_alloc+0x5d/0x170 bio_iov_iter_get_pages+0x82/0x4e0 ? bvec_alloc+0x91/0xc0 ? bio_alloc_bioset+0x19a/0x2a0 blkdev_direct_IO+0x282/0x480 ? __io_complete_rw_common+0xc0/0xc0 ? filemap_range_has_page+0x82/0xc0 generic_file_direct_write+0x9d/0x1a0 ? inode_update_time+0x24/0x30 __generic_file_write_iter+0xbd/0x1e0 blkdev_write_iter+0xb4/0x150 ? io_import_iovec+0x8d/0x340 io_write+0xf9/0x300 io_issue_sqe+0x3c3/0x1d30 ? sysvec_reschedule_ipi+0x6c/0x80 __io_queue_sqe+0x33/0x240 ? fget+0x76/0xa0 io_submit_sqes+0xe6a/0x18d0 ? __fget_light+0xd1/0x100 __x64_sys_io_uring_enter+0x199/0x880 ? __context_tracking_enter+0x1f/0x70 ? irqentry_exit_to_user_mode+0x24/0x30 ? irqentry_exit+0x1d/0x30 ? __context_tracking_exit+0xe/0x70 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7fc97c11a7be < snip > </TASK> ---[ end trace 48b2e0e67debcaeb ]--- RIP: 0010:internal_get_user_pages_fast+0x340/0x990 < snip > Kernel panic - not syncing: Fatal exception Kernel Offset: disabled

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.1.4-1DEBIAN-CVE-2022-48986
Debian:13linux6.1.4-1DEBIAN-CVE-2022-48986
Debian:14linux6.1.4-1DEBIAN-CVE-2022-48986
Ubuntu:22.04:LTSlinux5.15.0-67.74UBUNTU-CVE-2022-48986
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2022-48986
Ubuntu:22.04:LTSlinux-aws5.15.0-1031.35UBUNTU-CVE-2022-48986
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2022-48986
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2022-48986
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2022-48986
Ubuntu:22.04:LTSlinux-azure5.15.0-1034.41UBUNTU-CVE-2022-48986
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2022-48986
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2022-48986
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2022-48986
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1034.41.1UBUNTU-CVE-2022-48986
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2022-48986
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2022-48986
Ubuntu:22.04:LTSlinux-gcp5.15.0-1030.37UBUNTU-CVE-2022-48986
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2022-48986
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2022-48986
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2022-48986
Ubuntu:22.04:LTSlinux-gke5.15.0-1028.33UBUNTU-CVE-2022-48986
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1016.21UBUNTU-CVE-2022-48986
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2022-48986
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2022-48986
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2022-48986
Ubuntu:22.04:LTSlinux-ibm5.15.0-1026.29UBUNTU-CVE-2022-48986
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1026.31UBUNTU-CVE-2022-48986
Ubuntu:22.04:LTSlinux-kvm5.15.0-1029.34UBUNTU-CVE-2022-48986
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-67.74UBUNTU-CVE-2022-48986
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2022-48986
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2022-48986
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2022-48986
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1023.23UBUNTU-CVE-2022-48986
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2022-48986
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2022-48986
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2022-48986
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2022-48986
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2022-48986
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2022-48986
Ubuntu:22.04:LTSlinux-oracle5.15.0-1030.36UBUNTU-CVE-2022-48986
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2022-48986
Ubuntu:22.04:LTSlinux-raspi5.15.0-1025.27UBUNTU-CVE-2022-48986
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2022-48986
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2022-48986
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2022-48986
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2022-48986
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2022-48986
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2022-48986
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2022-48986
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2022-48986

Affected products (as reported)

VendorProductVersions
Linux Linux 414fd080d125408cb15d04ff4907e1dd8145c8c7 – before 04edfa3dc06ecfc6133a33bc7271298782dee875414fd080d125408cb15d04ff4907e1dd8145c8c7 – before f1cf856123ceb766c49967ec79b841030fa1741f414fd080d125408cb15d04ff4907e1dd8145c8c7 – before 3ac29732a2ffa64c7de13a072b0f2848b9c11037414fd080d125408cb15d04ff4907e1dd8145c8c7 – before e06d13c36ded750c72521b600293befebb4e56c5414fd080d125408cb15d04ff4907e1dd8145c8c7 – before fcd0ccd836ffad73d98a66f6fea7b16f735ea920c133d8eb894cb280f331608c6f1962ba9fbfe6b0538162d21ac877b060dc057c89f13718f5caffc58b1a7762e0dac5db42a003009fdcb425f10baa07
Linux Linux 5.0

References