GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-48842 (GCVE-0-2022-48842)

Vulnerability from cvelistv5 – Published: 2024-07-16 12:25 – Updated: 2026-05-11 18:48
VLAI
Title
ice: Fix race condition during interface enslave
Summary
In the Linux kernel, the following vulnerability has been resolved: ice: Fix race condition during interface enslave Commit 5dbbbd01cbba83 ("ice: Avoid RTNL lock when re-creating auxiliary device") changes a process of re-creation of aux device so ice_plug_aux_dev() is called from ice_service_task() context. This unfortunately opens a race window that can result in dead-lock when interface has left LAG and immediately enters LAG again. Reproducer: ``` #!/bin/sh ip link add lag0 type bond mode 1 miimon 100 ip link set lag0 for n in {1..10}; do echo Cycle: $n ip link set ens7f0 master lag0 sleep 1 ip link set ens7f0 nomaster done ``` This results in: [20976.208697] Workqueue: ice ice_service_task [ice] [20976.213422] Call Trace: [20976.215871] __schedule+0x2d1/0x830 [20976.219364] schedule+0x35/0xa0 [20976.222510] schedule_preempt_disabled+0xa/0x10 [20976.227043] __mutex_lock.isra.7+0x310/0x420 [20976.235071] enum_all_gids_of_dev_cb+0x1c/0x100 [ib_core] [20976.251215] ib_enum_roce_netdev+0xa4/0xe0 [ib_core] [20976.256192] ib_cache_setup_one+0x33/0xa0 [ib_core] [20976.261079] ib_register_device+0x40d/0x580 [ib_core] [20976.266139] irdma_ib_register_device+0x129/0x250 [irdma] [20976.281409] irdma_probe+0x2c1/0x360 [irdma] [20976.285691] auxiliary_bus_probe+0x45/0x70 [20976.289790] really_probe+0x1f2/0x480 [20976.298509] driver_probe_device+0x49/0xc0 [20976.302609] bus_for_each_drv+0x79/0xc0 [20976.306448] __device_attach+0xdc/0x160 [20976.310286] bus_probe_device+0x9d/0xb0 [20976.314128] device_add+0x43c/0x890 [20976.321287] __auxiliary_device_add+0x43/0x60 [20976.325644] ice_plug_aux_dev+0xb2/0x100 [ice] [20976.330109] ice_service_task+0xd0c/0xed0 [ice] [20976.342591] process_one_work+0x1a7/0x360 [20976.350536] worker_thread+0x30/0x390 [20976.358128] kthread+0x10a/0x120 [20976.365547] ret_from_fork+0x1f/0x40 ... [20976.438030] task:ip state:D stack: 0 pid:213658 ppid:213627 flags:0x00004084 [20976.446469] Call Trace: [20976.448921] __schedule+0x2d1/0x830 [20976.452414] schedule+0x35/0xa0 [20976.455559] schedule_preempt_disabled+0xa/0x10 [20976.460090] __mutex_lock.isra.7+0x310/0x420 [20976.464364] device_del+0x36/0x3c0 [20976.467772] ice_unplug_aux_dev+0x1a/0x40 [ice] [20976.472313] ice_lag_event_handler+0x2a2/0x520 [ice] [20976.477288] notifier_call_chain+0x47/0x70 [20976.481386] __netdev_upper_dev_link+0x18b/0x280 [20976.489845] bond_enslave+0xe05/0x1790 [bonding] [20976.494475] do_setlink+0x336/0xf50 [20976.502517] __rtnl_newlink+0x529/0x8b0 [20976.543441] rtnl_newlink+0x43/0x60 [20976.546934] rtnetlink_rcv_msg+0x2b1/0x360 [20976.559238] netlink_rcv_skb+0x4c/0x120 [20976.563079] netlink_unicast+0x196/0x230 [20976.567005] netlink_sendmsg+0x204/0x3d0 [20976.570930] sock_sendmsg+0x4c/0x50 [20976.574423] ____sys_sendmsg+0x1eb/0x250 [20976.586807] ___sys_sendmsg+0x7c/0xc0 [20976.606353] __sys_sendmsg+0x57/0xa0 [20976.609930] do_syscall_64+0x5b/0x1a0 [20976.613598] entry_SYSCALL_64_after_hwframe+0x65/0xca 1. Command 'ip link ... set nomaster' causes that ice_plug_aux_dev() is called from ice_service_task() context, aux device is created and associated device->lock is taken. 2. Command 'ip link ... set master...' calls ice's notifier under RTNL lock and that notifier calls ice_unplug_aux_dev(). That function tries to take aux device->lock but this is already taken by ice_plug_aux_dev() in step 1 3. Later ice_plug_aux_dev() tries to take RTNL lock but this is already taken in step 2 4. Dead-lock The patch fixes this issue by following changes: - Bit ICE_FLAG_PLUG_AUX_DEV is kept to be set during ice_plug_aux_dev() call in ice_service_task() - The bit is checked in ice_clear_rdma_cap() and only if it is not set then ice_unplug_aux_dev() is called. If it is set (in other words plugging of aux device was requested and ice_plug_aux_dev() is potentially running) then the function only clears the ---truncated---
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 16:56 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 41a8c548d47bcdbbd5e0fa40fbb7c95cc54bcb34 , < a9bbacc53d1f5ed8febbfdf31401d20e005f49ef (git)
Affected: 6d26421f742345acb6158780dd1e61f945615f06 , < e1014fc5572375658fa421531cedb6e084f477dc (git)
Affected: 5dbbbd01cbba831233c6ea9a3e6bfa133606d3c0 , < 5cb1ebdbc4342b1c2ce89516e19808d64417bdbc (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.15.24 , < 5.15.30 (semver)
Affected: 5.16.10 , < 5.16.16 (semver)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T15:25:01.534Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a9bbacc53d1f5ed8febbfdf31401d20e005f49ef"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e1014fc5572375658fa421531cedb6e084f477dc"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5cb1ebdbc4342b1c2ce89516e19808d64417bdbc"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-48842",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:56:50.883714Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:09.633Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/ice/ice.h",
            "drivers/net/ethernet/intel/ice/ice_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a9bbacc53d1f5ed8febbfdf31401d20e005f49ef",
              "status": "affected",
              "version": "41a8c548d47bcdbbd5e0fa40fbb7c95cc54bcb34",
              "versionType": "git"
            },
            {
              "lessThan": "e1014fc5572375658fa421531cedb6e084f477dc",
              "status": "affected",
              "version": "6d26421f742345acb6158780dd1e61f945615f06",
              "versionType": "git"
            },
            {
              "lessThan": "5cb1ebdbc4342b1c2ce89516e19808d64417bdbc",
              "status": "affected",
              "version": "5dbbbd01cbba831233c6ea9a3e6bfa133606d3c0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/ice/ice.h",
            "drivers/net/ethernet/intel/ice/ice_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5.15.30",
              "status": "affected",
              "version": "5.15.24",
              "versionType": "semver"
            },
            {
              "lessThan": "5.16.16",
              "status": "affected",
              "version": "5.16.10",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.30",
                  "versionStartIncluding": "5.15.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16.16",
                  "versionStartIncluding": "5.16.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: Fix race condition during interface enslave\n\nCommit 5dbbbd01cbba83 (\"ice: Avoid RTNL lock when re-creating\nauxiliary device\") changes a process of re-creation of aux device\nso ice_plug_aux_dev() is called from ice_service_task() context.\nThis unfortunately opens a race window that can result in dead-lock\nwhen interface has left LAG and immediately enters LAG again.\n\nReproducer:\n```\n#!/bin/sh\n\nip link add lag0 type bond mode 1 miimon 100\nip link set lag0\n\nfor n in {1..10}; do\n        echo Cycle: $n\n        ip link set ens7f0 master lag0\n        sleep 1\n        ip link set ens7f0 nomaster\ndone\n```\n\nThis results in:\n[20976.208697] Workqueue: ice ice_service_task [ice]\n[20976.213422] Call Trace:\n[20976.215871]  __schedule+0x2d1/0x830\n[20976.219364]  schedule+0x35/0xa0\n[20976.222510]  schedule_preempt_disabled+0xa/0x10\n[20976.227043]  __mutex_lock.isra.7+0x310/0x420\n[20976.235071]  enum_all_gids_of_dev_cb+0x1c/0x100 [ib_core]\n[20976.251215]  ib_enum_roce_netdev+0xa4/0xe0 [ib_core]\n[20976.256192]  ib_cache_setup_one+0x33/0xa0 [ib_core]\n[20976.261079]  ib_register_device+0x40d/0x580 [ib_core]\n[20976.266139]  irdma_ib_register_device+0x129/0x250 [irdma]\n[20976.281409]  irdma_probe+0x2c1/0x360 [irdma]\n[20976.285691]  auxiliary_bus_probe+0x45/0x70\n[20976.289790]  really_probe+0x1f2/0x480\n[20976.298509]  driver_probe_device+0x49/0xc0\n[20976.302609]  bus_for_each_drv+0x79/0xc0\n[20976.306448]  __device_attach+0xdc/0x160\n[20976.310286]  bus_probe_device+0x9d/0xb0\n[20976.314128]  device_add+0x43c/0x890\n[20976.321287]  __auxiliary_device_add+0x43/0x60\n[20976.325644]  ice_plug_aux_dev+0xb2/0x100 [ice]\n[20976.330109]  ice_service_task+0xd0c/0xed0 [ice]\n[20976.342591]  process_one_work+0x1a7/0x360\n[20976.350536]  worker_thread+0x30/0x390\n[20976.358128]  kthread+0x10a/0x120\n[20976.365547]  ret_from_fork+0x1f/0x40\n...\n[20976.438030] task:ip              state:D stack:    0 pid:213658 ppid:213627 flags:0x00004084\n[20976.446469] Call Trace:\n[20976.448921]  __schedule+0x2d1/0x830\n[20976.452414]  schedule+0x35/0xa0\n[20976.455559]  schedule_preempt_disabled+0xa/0x10\n[20976.460090]  __mutex_lock.isra.7+0x310/0x420\n[20976.464364]  device_del+0x36/0x3c0\n[20976.467772]  ice_unplug_aux_dev+0x1a/0x40 [ice]\n[20976.472313]  ice_lag_event_handler+0x2a2/0x520 [ice]\n[20976.477288]  notifier_call_chain+0x47/0x70\n[20976.481386]  __netdev_upper_dev_link+0x18b/0x280\n[20976.489845]  bond_enslave+0xe05/0x1790 [bonding]\n[20976.494475]  do_setlink+0x336/0xf50\n[20976.502517]  __rtnl_newlink+0x529/0x8b0\n[20976.543441]  rtnl_newlink+0x43/0x60\n[20976.546934]  rtnetlink_rcv_msg+0x2b1/0x360\n[20976.559238]  netlink_rcv_skb+0x4c/0x120\n[20976.563079]  netlink_unicast+0x196/0x230\n[20976.567005]  netlink_sendmsg+0x204/0x3d0\n[20976.570930]  sock_sendmsg+0x4c/0x50\n[20976.574423]  ____sys_sendmsg+0x1eb/0x250\n[20976.586807]  ___sys_sendmsg+0x7c/0xc0\n[20976.606353]  __sys_sendmsg+0x57/0xa0\n[20976.609930]  do_syscall_64+0x5b/0x1a0\n[20976.613598]  entry_SYSCALL_64_after_hwframe+0x65/0xca\n\n1. Command \u0027ip link ... set nomaster\u0027 causes that ice_plug_aux_dev()\n   is called from ice_service_task() context, aux device is created\n   and associated device-\u003elock is taken.\n2. Command \u0027ip link ... set master...\u0027 calls ice\u0027s notifier under\n   RTNL lock and that notifier calls ice_unplug_aux_dev(). That\n   function tries to take aux device-\u003elock but this is already taken\n   by ice_plug_aux_dev() in step 1\n3. Later ice_plug_aux_dev() tries to take RTNL lock but this is already\n   taken in step 2\n4. Dead-lock\n\nThe patch fixes this issue by following changes:\n- Bit ICE_FLAG_PLUG_AUX_DEV is kept to be set during ice_plug_aux_dev()\n  call in ice_service_task()\n- The bit is checked in ice_clear_rdma_cap() and only if it is not set\n  then ice_unplug_aux_dev() is called. If it is set (in other words\n  plugging of aux device was requested and ice_plug_aux_dev() is\n  potentially running) then the function only clears the\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T18:48:13.309Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a9bbacc53d1f5ed8febbfdf31401d20e005f49ef"
        },
        {
          "url": "https://git.kernel.org/stable/c/e1014fc5572375658fa421531cedb6e084f477dc"
        },
        {
          "url": "https://git.kernel.org/stable/c/5cb1ebdbc4342b1c2ce89516e19808d64417bdbc"
        }
      ],
      "title": "ice: Fix race condition during interface enslave",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48842",
    "datePublished": "2024-07-16T12:25:12.499Z",
    "dateReserved": "2024-07-16T11:38:08.910Z",
    "dateUpdated": "2026-05-11T18:48:13.309Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-48842",
      "date": "2026-09-16",
      "epss": "0.00183",
      "percentile": "0.08133"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"5.15.30\", \"matchCriteriaId\": \"B4DCE220-813A-4393-8BEF-C705DCD12175\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.16\", \"versionEndExcluding\": \"5.16.16\", \"matchCriteriaId\": \"EDF25425-C006-411E-B842-0F12075B8C13\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:5.17:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"7BD5F8D9-54FA-4CB0-B4F0-CB0471FDDB2D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:5.17:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"E6E34B23-78B4-4516-9BD8-61B33F4AC49A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:5.17:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"C030FA3D-03F4-4FB9-9DBF-D08E5CAC51AA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:5.17:rc4:*:*:*:*:*:*\", \"matchCriteriaId\": \"B2D2677C-5389-4AE9-869D-0F881E80D923\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:5.17:rc5:*:*:*:*:*:*\", \"matchCriteriaId\": \"EFA3917C-C322-4D92-912D-ECE45B2E7416\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:5.17:rc6:*:*:*:*:*:*\", \"matchCriteriaId\": \"BED18363-5ABC-4639-8BBA-68E771E5BB3F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:5.17:rc7:*:*:*:*:*:*\", \"matchCriteriaId\": \"7F635F96-FA0A-4769-ADE8-232B3AC9116D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:5.17:rc8:*:*:*:*:*:*\", \"matchCriteriaId\": \"FD39FE73-2A9D-4C92-AE7A-CA22F84B228D\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nice: Fix race condition during interface enslave\\n\\nCommit 5dbbbd01cbba83 (\\\"ice: Avoid RTNL lock when re-creating\\nauxiliary device\\\") changes a process of re-creation of aux device\\nso ice_plug_aux_dev() is called from ice_service_task() context.\\nThis unfortunately opens a race window that can result in dead-lock\\nwhen interface has left LAG and immediately enters LAG again.\\n\\nReproducer:\\n```\\n#!/bin/sh\\n\\nip link add lag0 type bond mode 1 miimon 100\\nip link set lag0\\n\\nfor n in {1..10}; do\\n        echo Cycle: $n\\n        ip link set ens7f0 master lag0\\n        sleep 1\\n        ip link set ens7f0 nomaster\\ndone\\n```\\n\\nThis results in:\\n[20976.208697] Workqueue: ice ice_service_task [ice]\\n[20976.213422] Call Trace:\\n[20976.215871]  __schedule+0x2d1/0x830\\n[20976.219364]  schedule+0x35/0xa0\\n[20976.222510]  schedule_preempt_disabled+0xa/0x10\\n[20976.227043]  __mutex_lock.isra.7+0x310/0x420\\n[20976.235071]  enum_all_gids_of_dev_cb+0x1c/0x100 [ib_core]\\n[20976.251215]  ib_enum_roce_netdev+0xa4/0xe0 [ib_core]\\n[20976.256192]  ib_cache_setup_one+0x33/0xa0 [ib_core]\\n[20976.261079]  ib_register_device+0x40d/0x580 [ib_core]\\n[20976.266139]  irdma_ib_register_device+0x129/0x250 [irdma]\\n[20976.281409]  irdma_probe+0x2c1/0x360 [irdma]\\n[20976.285691]  auxiliary_bus_probe+0x45/0x70\\n[20976.289790]  really_probe+0x1f2/0x480\\n[20976.298509]  driver_probe_device+0x49/0xc0\\n[20976.302609]  bus_for_each_drv+0x79/0xc0\\n[20976.306448]  __device_attach+0xdc/0x160\\n[20976.310286]  bus_probe_device+0x9d/0xb0\\n[20976.314128]  device_add+0x43c/0x890\\n[20976.321287]  __auxiliary_device_add+0x43/0x60\\n[20976.325644]  ice_plug_aux_dev+0xb2/0x100 [ice]\\n[20976.330109]  ice_service_task+0xd0c/0xed0 [ice]\\n[20976.342591]  process_one_work+0x1a7/0x360\\n[20976.350536]  worker_thread+0x30/0x390\\n[20976.358128]  kthread+0x10a/0x120\\n[20976.365547]  ret_from_fork+0x1f/0x40\\n...\\n[20976.438030] task:ip              state:D stack:    0 pid:213658 ppid:213627 flags:0x00004084\\n[20976.446469] Call Trace:\\n[20976.448921]  __schedule+0x2d1/0x830\\n[20976.452414]  schedule+0x35/0xa0\\n[20976.455559]  schedule_preempt_disabled+0xa/0x10\\n[20976.460090]  __mutex_lock.isra.7+0x310/0x420\\n[20976.464364]  device_del+0x36/0x3c0\\n[20976.467772]  ice_unplug_aux_dev+0x1a/0x40 [ice]\\n[20976.472313]  ice_lag_event_handler+0x2a2/0x520 [ice]\\n[20976.477288]  notifier_call_chain+0x47/0x70\\n[20976.481386]  __netdev_upper_dev_link+0x18b/0x280\\n[20976.489845]  bond_enslave+0xe05/0x1790 [bonding]\\n[20976.494475]  do_setlink+0x336/0xf50\\n[20976.502517]  __rtnl_newlink+0x529/0x8b0\\n[20976.543441]  rtnl_newlink+0x43/0x60\\n[20976.546934]  rtnetlink_rcv_msg+0x2b1/0x360\\n[20976.559238]  netlink_rcv_skb+0x4c/0x120\\n[20976.563079]  netlink_unicast+0x196/0x230\\n[20976.567005]  netlink_sendmsg+0x204/0x3d0\\n[20976.570930]  sock_sendmsg+0x4c/0x50\\n[20976.574423]  ____sys_sendmsg+0x1eb/0x250\\n[20976.586807]  ___sys_sendmsg+0x7c/0xc0\\n[20976.606353]  __sys_sendmsg+0x57/0xa0\\n[20976.609930]  do_syscall_64+0x5b/0x1a0\\n[20976.613598]  entry_SYSCALL_64_after_hwframe+0x65/0xca\\n\\n1. Command \u0027ip link ... set nomaster\u0027 causes that ice_plug_aux_dev()\\n   is called from ice_service_task() context, aux device is created\\n   and associated device-\u003elock is taken.\\n2. Command \u0027ip link ... set master...\u0027 calls ice\u0027s notifier under\\n   RTNL lock and that notifier calls ice_unplug_aux_dev(). That\\n   function tries to take aux device-\u003elock but this is already taken\\n   by ice_plug_aux_dev() in step 1\\n3. Later ice_plug_aux_dev() tries to take RTNL lock but this is already\\n   taken in step 2\\n4. Dead-lock\\n\\nThe patch fixes this issue by following changes:\\n- Bit ICE_FLAG_PLUG_AUX_DEV is kept to be set during ice_plug_aux_dev()\\n  call in ice_service_task()\\n- The bit is checked in ice_clear_rdma_cap() and only if it is not set\\n  then ice_unplug_aux_dev() is called. If it is set (in other words\\n  plugging of aux device was requested and ice_plug_aux_dev() is\\n  potentially running) then the function only clears the\\n---truncated---\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ice: corrige la condici\\u00f3n de ejecuci\\u00f3n durante la esclavitud de la interfaz. El commit 5dbbbd01cbba83 (\\\"ice: evita el bloqueo RTNL al recrear el dispositivo auxiliar\\\") cambia el proceso de recreaci\\u00f3n del dispositivo auxiliar para que ice_plug_aux_dev( ) se llama desde el contexto ice_service_task(). Desafortunadamente, esto abre una ventana de ejecuci\\u00f3n que puede resultar en un punto muerto cuando la interfaz sale de LAG e inmediatamente ingresa a LAG nuevamente. Reproductor: ``` #!/bin/sh enlace ip agregar lag0 tipo modo de enlace 1 miimon 100 enlace ip configurar lag0 para n en {1..10}; do echo Cycle: $n ip link set ens7f0 master lag0 sleep 1 ip link set ens7f0 nomaster done ``` Esto da como resultado: [20976.208697] Cola de trabajo: ice ice_service_task [ice] [20976.213422] Seguimiento de llamadas: [20976.215871] __schedule+0x2d1/ 0x830 [20976.219364] programaci\\u00f3n+0x35/0xa0 [20976.222510] programaci\\u00f3n_preempt_disabled+0xa/0x10 [20976.227043] __mutex_lock.isra.7+0x310/0x420 [20976.235071] enum_all_gids_of_de v_cb+0x1c/0x100 [ib_core] [20976.251215] ib_enum_roce_netdev+0xa4/0xe0 [ib_core ] [20976.256192] ib_cache_setup_one+0x33/0xa0 [ib_core] [20976.261079] ib_register_device+0x40d/0x580 [ib_core] [20976.266139] irdma_ib_register_device+0x129/0x250 [irdma] 0976.281409] irdma_probe+0x2c1/0x360 [irdma] [20976.285691] sonda_bus_auxiliar+ 0x45/0x70 [20976.289790] very_probe+0x1f2/0x480 [20976.298509] driver_probe_device+0x49/0xc0 [20976.302609] bus_for_each_drv+0x79/0xc0 [20976.306448] adjuntar+0xdc/0x160 [20976.310286] bus_probe_device+0x9d/0xb0 [20976.314128] dispositivo_add+0x43c/ 0x890 [20976.321287] __auxiliary_device_add+0x43/0x60 [20976.325644] ice_plug_aux_dev+0xb2/0x100 [ice] [20976.330109] ice_service_task+0xd0c/0xed0 [ice] 1] proceso_un_trabajo+0x1a7/0x360 [20976.350536] hilo_trabajador+0x30/0x390 [20976.358128] kthread+0x10a/0x120 [20976.365547] ret_from_fork+0x1f/0x40 ... [20976.438030] tarea:ip estado:D pila: 0 pid:213658 ppid:213627 banderas:0x00004084 [20976.446469] Seguimiento de llamadas: 76.448921] __programaci\\u00f3n+0x2d1/ 0x830 [20976.452414] programaci\\u00f3n+0x35/0xa0 [20976.455559] programaci\\u00f3n_preempt_disabled+0xa/0x10 [20976.460090] __mutex_lock.isra.7+0x310/0x420 [20976.464364 dispositivo_del+0x36/0x 3c0 [20976.467772] ice_unplug_aux_dev+0x1a/0x40 [hielo] [20976.472313 ] ice_lag_event_handler+0x2a2/0x520 [ice] [20976.477288] notifier_call_chain+0x47/0x70 [20976.481386] __netdev_upper_dev_link+0x18b/0x280 [20976.489845] bond_enslave+0xe05/0 x1790 [vinculaci\\u00f3n] [20976.494475] do_setlink+0x336/0xf50 [20976.502517] __rtnl_newlink+0x529 /0x8b0 [20976.543441] rtnl_newlink+0x43/0x60 [20976.546934] rtnetlink_rcv_msg+0x2b1/0x360 [20976.559238] netlink_rcv_skb+0x4c/0x120 [20976.563079] _unicast+0x196/0x230 [20976.567005] netlink_sendmsg+0x204/0x3d0 [20976.570930] sock_sendmsg+0x4c/0x50 [20976.574423] ____sys_sendmsg+0x1eb/0x250 [20976.586807] ___sys_sendmsg+0x7c/0xc0 [20976.606353] __sys_sendmsg+0x57/0xa0 [20976.609930] call_64+0x5b/0x1a0 [20976.613598] Entry_SYSCALL_64_after_hwframe+0x65/0xca 1. Comando \u0027ip link... set nomaster\u0027 provoca que se llame a ice_plug_aux_dev() desde el contexto ice_service_task(), se crea el dispositivo auxiliar y se toma el dispositivo asociado-\u0026gt;bloqueo. 2. El comando \u0027ip link... set master...\u0027 llama al notificador de ice bajo bloqueo RTNL y ese notificador llama a ice_unplug_aux_dev(). Esa funci\\u00f3n intenta tomar el dispositivo auxiliar-\u0026gt;bloqueo, pero esto ya lo tom\\u00f3 ice_plug_aux_dev() en el paso 1 3. M\\u00e1s tarde, ice_plug_aux_dev() intenta tomar el bloqueo RTNL pero esto ya lo tom\\u00f3 en el paso 2 4. Bloqueo muerto El parche soluciona esto problema mediante los siguientes cambios: - El bit ICE_FLAG_PLUG_AUX_DEV se mantiene configurado durante la llamada a ice_plug_aux_dev() en ice_service_task() - El bit se verifica en ice_clear_rdma_cap() y solo si no est\\u00e1 configurado, se llama a ice_unplug_aux_dev(). l ---truncado---\"}]",
      "id": "CVE-2022-48842",
      "lastModified": "2024-11-21T07:34:11.560",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 4.7, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.0, \"impactScore\": 3.6}]}",
      "published": "2024-07-16T13:15:11.577",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/5cb1ebdbc4342b1c2ce89516e19808d64417bdbc\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Mailing List\", \"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/a9bbacc53d1f5ed8febbfdf31401d20e005f49ef\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Mailing List\", \"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/e1014fc5572375658fa421531cedb6e084f477dc\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Mailing List\", \"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/5cb1ebdbc4342b1c2ce89516e19808d64417bdbc\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/a9bbacc53d1f5ed8febbfdf31401d20e005f49ef\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/e1014fc5572375658fa421531cedb6e084f477dc\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-362\"}, {\"lang\": \"en\", \"value\": \"CWE-667\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-48842\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-07-16T13:15:11.577\",\"lastModified\":\"2026-06-17T05:16:21.583\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nice: Fix race condition during interface enslave\\n\\nCommit 5dbbbd01cbba83 (\\\"ice: Avoid RTNL lock when re-creating\\nauxiliary device\\\") changes a process of re-creation of aux device\\nso ice_plug_aux_dev() is called from ice_service_task() context.\\nThis unfortunately opens a race window that can result in dead-lock\\nwhen interface has left LAG and immediately enters LAG again.\\n\\nReproducer:\\n```\\n#!/bin/sh\\n\\nip link add lag0 type bond mode 1 miimon 100\\nip link set lag0\\n\\nfor n in {1..10}; do\\n        echo Cycle: $n\\n        ip link set ens7f0 master lag0\\n        sleep 1\\n        ip link set ens7f0 nomaster\\ndone\\n```\\n\\nThis results in:\\n[20976.208697] Workqueue: ice ice_service_task [ice]\\n[20976.213422] Call Trace:\\n[20976.215871]  __schedule+0x2d1/0x830\\n[20976.219364]  schedule+0x35/0xa0\\n[20976.222510]  schedule_preempt_disabled+0xa/0x10\\n[20976.227043]  __mutex_lock.isra.7+0x310/0x420\\n[20976.235071]  enum_all_gids_of_dev_cb+0x1c/0x100 [ib_core]\\n[20976.251215]  ib_enum_roce_netdev+0xa4/0xe0 [ib_core]\\n[20976.256192]  ib_cache_setup_one+0x33/0xa0 [ib_core]\\n[20976.261079]  ib_register_device+0x40d/0x580 [ib_core]\\n[20976.266139]  irdma_ib_register_device+0x129/0x250 [irdma]\\n[20976.281409]  irdma_probe+0x2c1/0x360 [irdma]\\n[20976.285691]  auxiliary_bus_probe+0x45/0x70\\n[20976.289790]  really_probe+0x1f2/0x480\\n[20976.298509]  driver_probe_device+0x49/0xc0\\n[20976.302609]  bus_for_each_drv+0x79/0xc0\\n[20976.306448]  __device_attach+0xdc/0x160\\n[20976.310286]  bus_probe_device+0x9d/0xb0\\n[20976.314128]  device_add+0x43c/0x890\\n[20976.321287]  __auxiliary_device_add+0x43/0x60\\n[20976.325644]  ice_plug_aux_dev+0xb2/0x100 [ice]\\n[20976.330109]  ice_service_task+0xd0c/0xed0 [ice]\\n[20976.342591]  process_one_work+0x1a7/0x360\\n[20976.350536]  worker_thread+0x30/0x390\\n[20976.358128]  kthread+0x10a/0x120\\n[20976.365547]  ret_from_fork+0x1f/0x40\\n...\\n[20976.438030] task:ip              state:D stack:    0 pid:213658 ppid:213627 flags:0x00004084\\n[20976.446469] Call Trace:\\n[20976.448921]  __schedule+0x2d1/0x830\\n[20976.452414]  schedule+0x35/0xa0\\n[20976.455559]  schedule_preempt_disabled+0xa/0x10\\n[20976.460090]  __mutex_lock.isra.7+0x310/0x420\\n[20976.464364]  device_del+0x36/0x3c0\\n[20976.467772]  ice_unplug_aux_dev+0x1a/0x40 [ice]\\n[20976.472313]  ice_lag_event_handler+0x2a2/0x520 [ice]\\n[20976.477288]  notifier_call_chain+0x47/0x70\\n[20976.481386]  __netdev_upper_dev_link+0x18b/0x280\\n[20976.489845]  bond_enslave+0xe05/0x1790 [bonding]\\n[20976.494475]  do_setlink+0x336/0xf50\\n[20976.502517]  __rtnl_newlink+0x529/0x8b0\\n[20976.543441]  rtnl_newlink+0x43/0x60\\n[20976.546934]  rtnetlink_rcv_msg+0x2b1/0x360\\n[20976.559238]  netlink_rcv_skb+0x4c/0x120\\n[20976.563079]  netlink_unicast+0x196/0x230\\n[20976.567005]  netlink_sendmsg+0x204/0x3d0\\n[20976.570930]  sock_sendmsg+0x4c/0x50\\n[20976.574423]  ____sys_sendmsg+0x1eb/0x250\\n[20976.586807]  ___sys_sendmsg+0x7c/0xc0\\n[20976.606353]  __sys_sendmsg+0x57/0xa0\\n[20976.609930]  do_syscall_64+0x5b/0x1a0\\n[20976.613598]  entry_SYSCALL_64_after_hwframe+0x65/0xca\\n\\n1. Command \u0027ip link ... set nomaster\u0027 causes that ice_plug_aux_dev()\\n   is called from ice_service_task() context, aux device is created\\n   and associated device-\u003elock is taken.\\n2. Command \u0027ip link ... set master...\u0027 calls ice\u0027s notifier under\\n   RTNL lock and that notifier calls ice_unplug_aux_dev(). That\\n   function tries to take aux device-\u003elock but this is already taken\\n   by ice_plug_aux_dev() in step 1\\n3. Later ice_plug_aux_dev() tries to take RTNL lock but this is already\\n   taken in step 2\\n4. Dead-lock\\n\\nThe patch fixes this issue by following changes:\\n- Bit ICE_FLAG_PLUG_AUX_DEV is kept to be set during ice_plug_aux_dev()\\n  call in ice_service_task()\\n- The bit is checked in ice_clear_rdma_cap() and only if it is not set\\n  then ice_unplug_aux_dev() is called. If it is set (in other words\\n  plugging of aux device was requested and ice_plug_aux_dev() is\\n  potentially running) then the function only clears the\\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ice: corrige la condici\u00f3n de ejecuci\u00f3n durante la esclavitud de la interfaz. El commit 5dbbbd01cbba83 (\\\"ice: evita el bloqueo RTNL al recrear el dispositivo auxiliar\\\") cambia el proceso de recreaci\u00f3n del dispositivo auxiliar para que ice_plug_aux_dev( ) se llama desde el contexto ice_service_task(). Desafortunadamente, esto abre una ventana de ejecuci\u00f3n que puede resultar en un punto muerto cuando la interfaz sale de LAG e inmediatamente ingresa a LAG nuevamente. Reproductor: ``` #!/bin/sh enlace ip agregar lag0 tipo modo de enlace 1 miimon 100 enlace ip configurar lag0 para n en {1..10}; do echo Cycle: $n ip link set ens7f0 master lag0 sleep 1 ip link set ens7f0 nomaster done ``` Esto da como resultado: [20976.208697] Cola de trabajo: ice ice_service_task [ice] [20976.213422] Seguimiento de llamadas: [20976.215871] __schedule+0x2d1/ 0x830 [20976.219364] programaci\u00f3n+0x35/0xa0 [20976.222510] programaci\u00f3n_preempt_disabled+0xa/0x10 [20976.227043] __mutex_lock.isra.7+0x310/0x420 [20976.235071] enum_all_gids_of_de v_cb+0x1c/0x100 [ib_core] [20976.251215] ib_enum_roce_netdev+0xa4/0xe0 [ib_core ] [20976.256192] ib_cache_setup_one+0x33/0xa0 [ib_core] [20976.261079] ib_register_device+0x40d/0x580 [ib_core] [20976.266139] irdma_ib_register_device+0x129/0x250 [irdma] 0976.281409] irdma_probe+0x2c1/0x360 [irdma] [20976.285691] sonda_bus_auxiliar+ 0x45/0x70 [20976.289790] very_probe+0x1f2/0x480 [20976.298509] driver_probe_device+0x49/0xc0 [20976.302609] bus_for_each_drv+0x79/0xc0 [20976.306448] adjuntar+0xdc/0x160 [20976.310286] bus_probe_device+0x9d/0xb0 [20976.314128] dispositivo_add+0x43c/ 0x890 [20976.321287] __auxiliary_device_add+0x43/0x60 [20976.325644] ice_plug_aux_dev+0xb2/0x100 [ice] [20976.330109] ice_service_task+0xd0c/0xed0 [ice] 1] proceso_un_trabajo+0x1a7/0x360 [20976.350536] hilo_trabajador+0x30/0x390 [20976.358128] kthread+0x10a/0x120 [20976.365547] ret_from_fork+0x1f/0x40 ... [20976.438030] tarea:ip estado:D pila: 0 pid:213658 ppid:213627 banderas:0x00004084 [20976.446469] Seguimiento de llamadas: 76.448921] __programaci\u00f3n+0x2d1/ 0x830 [20976.452414] programaci\u00f3n+0x35/0xa0 [20976.455559] programaci\u00f3n_preempt_disabled+0xa/0x10 [20976.460090] __mutex_lock.isra.7+0x310/0x420 [20976.464364 dispositivo_del+0x36/0x 3c0 [20976.467772] ice_unplug_aux_dev+0x1a/0x40 [hielo] [20976.472313 ] ice_lag_event_handler+0x2a2/0x520 [ice] [20976.477288] notifier_call_chain+0x47/0x70 [20976.481386] __netdev_upper_dev_link+0x18b/0x280 [20976.489845] bond_enslave+0xe05/0 x1790 [vinculaci\u00f3n] [20976.494475] do_setlink+0x336/0xf50 [20976.502517] __rtnl_newlink+0x529 /0x8b0 [20976.543441] rtnl_newlink+0x43/0x60 [20976.546934] rtnetlink_rcv_msg+0x2b1/0x360 [20976.559238] netlink_rcv_skb+0x4c/0x120 [20976.563079] _unicast+0x196/0x230 [20976.567005] netlink_sendmsg+0x204/0x3d0 [20976.570930] sock_sendmsg+0x4c/0x50 [20976.574423] ____sys_sendmsg+0x1eb/0x250 [20976.586807] ___sys_sendmsg+0x7c/0xc0 [20976.606353] __sys_sendmsg+0x57/0xa0 [20976.609930] call_64+0x5b/0x1a0 [20976.613598] Entry_SYSCALL_64_after_hwframe+0x65/0xca 1. Comando \u0027ip link... set nomaster\u0027 provoca que se llame a ice_plug_aux_dev() desde el contexto ice_service_task(), se crea el dispositivo auxiliar y se toma el dispositivo asociado-\u0026gt;bloqueo. 2. El comando \u0027ip link... set master...\u0027 llama al notificador de ice bajo bloqueo RTNL y ese notificador llama a ice_unplug_aux_dev(). Esa funci\u00f3n intenta tomar el dispositivo auxiliar-\u0026gt;bloqueo, pero esto ya lo tom\u00f3 ice_plug_aux_dev() en el paso 1 3. M\u00e1s tarde, ice_plug_aux_dev() intenta tomar el bloqueo RTNL pero esto ya lo tom\u00f3 en el paso 2 4. Bloqueo muerto El parche soluciona esto problema mediante los siguientes cambios: - El bit ICE_FLAG_PLUG_AUX_DEV se mantiene configurado durante la llamada a ice_plug_aux_dev() en ice_service_task() - El bit se verifica en ice_clear_rdma_cap() y solo si no est\u00e1 configurado, se llama a ice_unplug_aux_dev(). l ---truncado---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/intel/ice/ice.h\",\"drivers/net/ethernet/intel/ice/ice_main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"41a8c548d47bcdbbd5e0fa40fbb7c95cc54bcb34\",\"lessThan\":\"a9bbacc53d1f5ed8febbfdf31401d20e005f49ef\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6d26421f742345acb6158780dd1e61f945615f06\",\"lessThan\":\"e1014fc5572375658fa421531cedb6e084f477dc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5dbbbd01cbba831233c6ea9a3e6bfa133606d3c0\",\"lessThan\":\"5cb1ebdbc4342b1c2ce89516e19808d64417bdbc\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/intel/ice/ice.h\",\"drivers/net/ethernet/intel/ice/ice_main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.15.24\",\"lessThan\":\"5.15.30\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.16.10\",\"lessThan\":\"5.16.16\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T16:56:50.883714Z\",\"id\":\"CVE-2022-48842\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"},{\"lang\":\"en\",\"value\":\"CWE-667\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.15.30\",\"matchCriteriaId\":\"B4DCE220-813A-4393-8BEF-C705DCD12175\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.16.16\",\"matchCriteriaId\":\"EDF25425-C006-411E-B842-0F12075B8C13\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.17:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"7BD5F8D9-54FA-4CB0-B4F0-CB0471FDDB2D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.17:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"E6E34B23-78B4-4516-9BD8-61B33F4AC49A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.17:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"C030FA3D-03F4-4FB9-9DBF-D08E5CAC51AA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.17:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"B2D2677C-5389-4AE9-869D-0F881E80D923\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.17:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"EFA3917C-C322-4D92-912D-ECE45B2E7416\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.17:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"BED18363-5ABC-4639-8BBA-68E771E5BB3F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.17:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F635F96-FA0A-4769-ADE8-232B3AC9116D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.17:rc8:*:*:*:*:*:*\",\"matchCriteriaId\":\"FD39FE73-2A9D-4C92-AE7A-CA22F84B228D\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/5cb1ebdbc4342b1c2ce89516e19808d64417bdbc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a9bbacc53d1f5ed8febbfdf31401d20e005f49ef\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e1014fc5572375658fa421531cedb6e084f477dc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5cb1ebdbc4342b1c2ce89516e19808d64417bdbc\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a9bbacc53d1f5ed8febbfdf31401d20e005f49ef\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e1014fc5572375658fa421531cedb6e084f477dc\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-02-02T10:57:33+00:00",
      "cve": "CVE-2022-48842",
      "id": "CVE-2022-48842",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "122",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ice: Fix race condition during interface enslave",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-48842.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-13T23:51:49Z",
      "cve": "CVE-2022-48842",
      "id": "CVE-2022-48842",
      "initial_release_date": "2024-07-18T03:05:45Z",
      "product_status:known_affected": "295",
      "product_status:known_not_affected": "254",
      "product_status:recommended": "426",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-48842",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-48842.json",
      "version": "46"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/a9bbacc53d1f5ed8febbfdf31401d20e005f49ef\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/e1014fc5572375658fa421531cedb6e084f477dc\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/5cb1ebdbc4342b1c2ce89516e19808d64417bdbc\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T15:25:01.534Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-48842\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:56:50.883714Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:21.038Z\"}}], \"cna\": {\"title\": \"ice: Fix race condition during interface enslave\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"41a8c548d47bcdbbd5e0fa40fbb7c95cc54bcb34\", \"lessThan\": \"a9bbacc53d1f5ed8febbfdf31401d20e005f49ef\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6d26421f742345acb6158780dd1e61f945615f06\", \"lessThan\": \"e1014fc5572375658fa421531cedb6e084f477dc\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5dbbbd01cbba831233c6ea9a3e6bfa133606d3c0\", \"lessThan\": \"5cb1ebdbc4342b1c2ce89516e19808d64417bdbc\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/ethernet/intel/ice/ice.h\", \"drivers/net/ethernet/intel/ice/ice_main.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.15.24\", \"lessThan\": \"5.15.30\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.16.10\", \"lessThan\": \"5.16.16\", \"versionType\": \"semver\"}], \"programFiles\": [\"drivers/net/ethernet/intel/ice/ice.h\", \"drivers/net/ethernet/intel/ice/ice_main.c\"], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/a9bbacc53d1f5ed8febbfdf31401d20e005f49ef\"}, {\"url\": \"https://git.kernel.org/stable/c/e1014fc5572375658fa421531cedb6e084f477dc\"}, {\"url\": \"https://git.kernel.org/stable/c/5cb1ebdbc4342b1c2ce89516e19808d64417bdbc\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nice: Fix race condition during interface enslave\\n\\nCommit 5dbbbd01cbba83 (\\\"ice: Avoid RTNL lock when re-creating\\nauxiliary device\\\") changes a process of re-creation of aux device\\nso ice_plug_aux_dev() is called from ice_service_task() context.\\nThis unfortunately opens a race window that can result in dead-lock\\nwhen interface has left LAG and immediately enters LAG again.\\n\\nReproducer:\\n```\\n#!/bin/sh\\n\\nip link add lag0 type bond mode 1 miimon 100\\nip link set lag0\\n\\nfor n in {1..10}; do\\n        echo Cycle: $n\\n        ip link set ens7f0 master lag0\\n        sleep 1\\n        ip link set ens7f0 nomaster\\ndone\\n```\\n\\nThis results in:\\n[20976.208697] Workqueue: ice ice_service_task [ice]\\n[20976.213422] Call Trace:\\n[20976.215871]  __schedule+0x2d1/0x830\\n[20976.219364]  schedule+0x35/0xa0\\n[20976.222510]  schedule_preempt_disabled+0xa/0x10\\n[20976.227043]  __mutex_lock.isra.7+0x310/0x420\\n[20976.235071]  enum_all_gids_of_dev_cb+0x1c/0x100 [ib_core]\\n[20976.251215]  ib_enum_roce_netdev+0xa4/0xe0 [ib_core]\\n[20976.256192]  ib_cache_setup_one+0x33/0xa0 [ib_core]\\n[20976.261079]  ib_register_device+0x40d/0x580 [ib_core]\\n[20976.266139]  irdma_ib_register_device+0x129/0x250 [irdma]\\n[20976.281409]  irdma_probe+0x2c1/0x360 [irdma]\\n[20976.285691]  auxiliary_bus_probe+0x45/0x70\\n[20976.289790]  really_probe+0x1f2/0x480\\n[20976.298509]  driver_probe_device+0x49/0xc0\\n[20976.302609]  bus_for_each_drv+0x79/0xc0\\n[20976.306448]  __device_attach+0xdc/0x160\\n[20976.310286]  bus_probe_device+0x9d/0xb0\\n[20976.314128]  device_add+0x43c/0x890\\n[20976.321287]  __auxiliary_device_add+0x43/0x60\\n[20976.325644]  ice_plug_aux_dev+0xb2/0x100 [ice]\\n[20976.330109]  ice_service_task+0xd0c/0xed0 [ice]\\n[20976.342591]  process_one_work+0x1a7/0x360\\n[20976.350536]  worker_thread+0x30/0x390\\n[20976.358128]  kthread+0x10a/0x120\\n[20976.365547]  ret_from_fork+0x1f/0x40\\n...\\n[20976.438030] task:ip              state:D stack:    0 pid:213658 ppid:213627 flags:0x00004084\\n[20976.446469] Call Trace:\\n[20976.448921]  __schedule+0x2d1/0x830\\n[20976.452414]  schedule+0x35/0xa0\\n[20976.455559]  schedule_preempt_disabled+0xa/0x10\\n[20976.460090]  __mutex_lock.isra.7+0x310/0x420\\n[20976.464364]  device_del+0x36/0x3c0\\n[20976.467772]  ice_unplug_aux_dev+0x1a/0x40 [ice]\\n[20976.472313]  ice_lag_event_handler+0x2a2/0x520 [ice]\\n[20976.477288]  notifier_call_chain+0x47/0x70\\n[20976.481386]  __netdev_upper_dev_link+0x18b/0x280\\n[20976.489845]  bond_enslave+0xe05/0x1790 [bonding]\\n[20976.494475]  do_setlink+0x336/0xf50\\n[20976.502517]  __rtnl_newlink+0x529/0x8b0\\n[20976.543441]  rtnl_newlink+0x43/0x60\\n[20976.546934]  rtnetlink_rcv_msg+0x2b1/0x360\\n[20976.559238]  netlink_rcv_skb+0x4c/0x120\\n[20976.563079]  netlink_unicast+0x196/0x230\\n[20976.567005]  netlink_sendmsg+0x204/0x3d0\\n[20976.570930]  sock_sendmsg+0x4c/0x50\\n[20976.574423]  ____sys_sendmsg+0x1eb/0x250\\n[20976.586807]  ___sys_sendmsg+0x7c/0xc0\\n[20976.606353]  __sys_sendmsg+0x57/0xa0\\n[20976.609930]  do_syscall_64+0x5b/0x1a0\\n[20976.613598]  entry_SYSCALL_64_after_hwframe+0x65/0xca\\n\\n1. Command \u0027ip link ... set nomaster\u0027 causes that ice_plug_aux_dev()\\n   is called from ice_service_task() context, aux device is created\\n   and associated device-\u003elock is taken.\\n2. Command \u0027ip link ... set master...\u0027 calls ice\u0027s notifier under\\n   RTNL lock and that notifier calls ice_unplug_aux_dev(). That\\n   function tries to take aux device-\u003elock but this is already taken\\n   by ice_plug_aux_dev() in step 1\\n3. Later ice_plug_aux_dev() tries to take RTNL lock but this is already\\n   taken in step 2\\n4. Dead-lock\\n\\nThe patch fixes this issue by following changes:\\n- Bit ICE_FLAG_PLUG_AUX_DEV is kept to be set during ice_plug_aux_dev()\\n  call in ice_service_task()\\n- The bit is checked in ice_clear_rdma_cap() and only if it is not set\\n  then ice_unplug_aux_dev() is called. If it is set (in other words\\n  plugging of aux device was requested and ice_plug_aux_dev() is\\n  potentially running) then the function only clears the\\n---truncated---\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.30\", \"versionStartIncluding\": \"5.15.24\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.16.16\", \"versionStartIncluding\": \"5.16.10\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-21T08:44:00.292Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-48842\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-21T08:44:00.292Z\", \"dateReserved\": \"2024-07-16T11:38:08.910Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-07-16T12:25:12.499Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.