Log in Start free

Vulnerability · Published Feb 26, 2025 · Assigned by Linux

CVE-2022-49703scsi: ibmvfc: Store vhost pointer during subcrq allocation

Medium 5.5

In plain English

A medium-severity null pointer dereference in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.3%top 81.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: scsi: ibmvfc: Store vhost pointer during subcrq allocation Currently the back pointer from a queue to the vhost adapter isn't set until after subcrq interrupt registration. The value is available when a queue is first allocated and can/should be also set for primary and async queues as well as subcrqs. This fixes a crash observed during kexec/kdump on Power 9 with legacy XICS interrupt controller where a pending subcrq interrupt from the previous kernel can be replayed immediately upon IRQ registration resulting in dereference of a garbage backpointer in ibmvfc_interrupt_scsi(). Kernel attempted to read user page (58) - exploit attempt? (uid: 0) BUG: Kernel NULL pointer dereference on read at 0x00000058 Faulting instruction address: 0xc008000003216a08 Oops: Kernel access of bad area, sig: 11 [#1] ... NIP [c008000003216a08] ibmvfc_interrupt_scsi+0x40/0xb0 [ibmvfc] LR [c0000000082079e8] __handle_irq_event_percpu+0x98/0x270 Call Trace: [c000000047fa3d80] [c0000000123e6180] 0xc0000000123e6180 (unreliable) [c000000047fa3df0] [c0000000082079e8] __handle_irq_event_percpu+0x98/0x270 [c000000047fa3ea0] [c000000008207d18] handle_irq_event+0x98/0x188 [c000000047fa3ef0] [c00000000820f564] handle_fasteoi_irq+0xc4/0x310 [c000000047fa3f40] [c000000008205c60] generic_handle_irq+0x50/0x80 [c000000047fa3f60] [c000000008015c40] __do_irq+0x70/0x1a0 [c000000047fa3f90] [c000000008016d7c] __do_IRQ+0x9c/0x130 [c000000014622f60] [0000000020000000] 0x20000000 [c000000014622ff0] [c000000008016e50] do_IRQ+0x40/0xa0 [c000000014623020] [c000000008017044] replay_soft_interrupts+0x194/0x2f0 [c000000014623210] [c0000000080172a8] arch_local_irq_restore+0x108/0x170 [c000000014623240] [c000000008eb1008] _raw_spin_unlock_irqrestore+0x58/0xb0 [c000000014623270] [c00000000820b12c] __setup_irq+0x49c/0x9f0 [c000000014623310] [c00000000820b7c0] request_threaded_irq+0x140/0x230 [c000000014623380] [c008000003212a50] ibmvfc_register_scsi_channel+0x1e8/0x2f0 [ibmvfc] [c000000014623450] [c008000003213d1c] ibmvfc_init_sub_crqs+0xc4/0x1f0 [ibmvfc] [c0000000146234d0] [c0080000032145a8] ibmvfc_reset_crq+0x150/0x210 [ibmvfc] [c000000014623550] [c0080000032147c8] ibmvfc_init_crq+0x160/0x280 [ibmvfc] [c0000000146235f0] [c00800000321a9cc] ibmvfc_probe+0x2a4/0x530 [ibmvfc]

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux5.18.14-1DEBIAN-CVE-2022-49703
Debian:13linux5.18.14-1DEBIAN-CVE-2022-49703
Debian:14linux5.18.14-1DEBIAN-CVE-2022-49703
Ubuntu:22.04:LTSlinux5.15.0-48.54UBUNTU-CVE-2022-49703
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2022-49703
Ubuntu:22.04:LTSlinux-aws5.15.0-1020.24UBUNTU-CVE-2022-49703
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2022-49703
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2022-49703
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2022-49703
Ubuntu:22.04:LTSlinux-azure5.15.0-1020.25UBUNTU-CVE-2022-49703
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2022-49703
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2022-49703
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2022-49703
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1024.30.1UBUNTU-CVE-2022-49703
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2022-49703
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2022-49703
Ubuntu:22.04:LTSlinux-gcp5.15.0-1018.24UBUNTU-CVE-2022-49703
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2022-49703
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2022-49703
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2022-49703
Ubuntu:22.04:LTSlinux-gke5.15.0-1016.19UBUNTU-CVE-2022-49703
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1003.5UBUNTU-CVE-2022-49703
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2022-49703
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2022-49703
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2022-49703
Ubuntu:22.04:LTSlinux-ibm5.15.0-1015.17UBUNTU-CVE-2022-49703
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2022-49703
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1016.21UBUNTU-CVE-2022-49703
Ubuntu:22.04:LTSlinux-kvm5.15.0-1018.22UBUNTU-CVE-2022-49703
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-48.54UBUNTU-CVE-2022-49703
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2022-49703
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2022-49703
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2022-49703
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1007.7UBUNTU-CVE-2022-49703
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2022-49703
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2022-49703
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2022-49703
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2022-49703
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2022-49703
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2022-49703
Ubuntu:22.04:LTSlinux-oracle5.15.0-1018.23UBUNTU-CVE-2022-49703
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2022-49703
Ubuntu:22.04:LTSlinux-raspi5.15.0-1015.17UBUNTU-CVE-2022-49703
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2022-49703
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2022-49703
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2022-49703
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2022-49703
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2022-49703
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2022-49703
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2022-49703
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2022-49703

Affected products (as reported)

VendorProductVersions
Linux Linux 3034ebe26389740bb6b4a463e05afb51dc93c336 – before 8540f66196ca35b7b5e902932571c18b9fde0cd13034ebe26389740bb6b4a463e05afb51dc93c336 – before 6d38e3b614ded59da8b95377a98df969a5a5627a3034ebe26389740bb6b4a463e05afb51dc93c336 – before aeaadcde1a60138bceb65de3cdaeec78170b4459
Linux Linux 5.12

Weakness: CWE-476 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References