https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 01:26:51 +0000 https://vulnerability.circl.lu/vuln/cve-2022-50422 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>scsi: libsas: Fix use-after-free bug in smp_execute_task_sg()</p> <p>When executing SMP task failed, the smp_execute_task_sg() calls del_timer() to delete &#34;slow_task-&gt;timer&#34;. However, if the timer handler sas_task_internal_timedout() is running, the del_timer() in smp_execute_task_sg() will not stop it and a UAF will happen. The process is shown below:</p> <p>(thread 1) | (thread 2) smp_execute_task_sg() | sas_task_internal_timedout() ... | del_timer() | ... | ... sas_free_task(task) | kfree(task-&gt;slow_task) //FREE| | task-&gt;slow_task-&gt;... //USE</p> <p>Fix by calling del_timer_sync() in smp_execute_task_sg(), which makes sure the timer handler have finished before the &#34;task-&gt;slow_task&#34; is deallocated.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>scsi: libsas: Fix use-after-free bug in smp_execute_task_sg()</p> <p>When executing SMP task failed, the smp_execute_task_sg() calls del_timer() to delete &#34;slow_task-&gt;timer&#34;. However, if the timer handler sas_task_internal_timedout() is running, the del_timer() in smp_execute_task_sg() will not stop it and a UAF will happen. The process is shown below:</p> <p>(thread 1) | (thread 2) smp_execute_task_sg() | sas_task_internal_timedout() ... | del_timer() | ... | ... sas_free_task(task) | kfree(task-&gt;slow_task) //FREE| | task-&gt;slow_task-&gt;... //USE</p> <p>Fix by calling del_timer_sync() in smp_execute_task_sg(), which makes sure the timer handler have finished before the &#34;task-&gt;slow_task&#34; is deallocated.</p> https://vulnerability.circl.lu/vuln/cve-2022-50422