cve-2022-48868
Vulnerability from cvelistv5
Published
2024-08-21 06:09
Modified
2024-11-04 12:18
Severity ?
Summary
dmaengine: idxd: Let probe fail when workqueue cannot be enabled
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/0f150134dd795ffcd60b798a85ab737d8d010fb7Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/99dc4520b74e7ca8e9dc9abe37a0b10b49467960Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b51b75f0604f17c0f6f3b6f68f1a521a5cc6b04fPatch
Impacted products
Vendor Product Version
Linux Linux Version: 5.15
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-48868",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:05:38.503495Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:32:54.625Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/dma/idxd/device.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0f150134dd79",
              "status": "affected",
              "version": "1f2bb40337f0",
              "versionType": "git"
            },
            {
              "lessThan": "99dc4520b74e",
              "status": "affected",
              "version": "1f2bb40337f0",
              "versionType": "git"
            },
            {
              "lessThan": "b51b75f0604f",
              "status": "affected",
              "version": "1f2bb40337f0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/dma/idxd/device.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.90",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: Let probe fail when workqueue cannot be enabled\n\nThe workqueue is enabled when the appropriate driver is loaded and\ndisabled when the driver is removed. When the driver is removed it\nassumes that the workqueue was enabled successfully and proceeds to\nfree allocations made during workqueue enabling.\n\nFailure during workqueue enabling does not prevent the driver from\nbeing loaded. This is because the error path within drv_enable_wq()\nreturns success unless a second failure is encountered\nduring the error path. By returning success it is possible to load\nthe driver even if the workqueue cannot be enabled and\nallocations that do not exist are attempted to be freed during\ndriver remove.\n\nSome examples of problematic flows:\n(a)\n\n idxd_dmaengine_drv_probe() -\u003e drv_enable_wq() -\u003e idxd_wq_request_irq():\n In above flow, if idxd_wq_request_irq() fails then\n idxd_wq_unmap_portal() is called on error exit path, but\n drv_enable_wq() returns 0 because idxd_wq_disable() succeeds. The\n driver is thus loaded successfully.\n\n idxd_dmaengine_drv_remove()-\u003edrv_disable_wq()-\u003eidxd_wq_unmap_portal()\n Above flow on driver unload triggers the WARN in devm_iounmap() because\n the device resource has already been removed during error path of\n drv_enable_wq().\n\n(b)\n\n idxd_dmaengine_drv_probe() -\u003e drv_enable_wq() -\u003e idxd_wq_request_irq():\n In above flow, if idxd_wq_request_irq() fails then\n idxd_wq_init_percpu_ref() is never called to initialize the percpu\n counter, yet the driver loads successfully because drv_enable_wq()\n returns 0.\n\n idxd_dmaengine_drv_remove()-\u003e__idxd_wq_quiesce()-\u003epercpu_ref_kill():\n Above flow on driver unload triggers a BUG when attempting to drop the\n initial ref of the uninitialized percpu ref:\n BUG: kernel NULL pointer dereference, address: 0000000000000010\n\nFix the drv_enable_wq() error path by returning the original error that\nindicates failure of workqueue enabling. This ensures that the probe\nfails when an error is encountered and the driver remove paths are only\nattempted when the workqueue was enabled successfully."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-04T12:18:09.821Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0f150134dd795ffcd60b798a85ab737d8d010fb7"
        },
        {
          "url": "https://git.kernel.org/stable/c/99dc4520b74e7ca8e9dc9abe37a0b10b49467960"
        },
        {
          "url": "https://git.kernel.org/stable/c/b51b75f0604f17c0f6f3b6f68f1a521a5cc6b04f"
        }
      ],
      "title": "dmaengine: idxd: Let probe fail when workqueue cannot be enabled",
      "x_generator": {
        "engine": "bippy-9e1c9544281a"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48868",
    "datePublished": "2024-08-21T06:09:58.431Z",
    "dateReserved": "2024-07-16T11:38:08.921Z",
    "dateUpdated": "2024-11-04T12:18:09.821Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-48868\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-08-21T07:15:04.020\",\"lastModified\":\"2024-09-04T18:38:59.113\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndmaengine: idxd: Let probe fail when workqueue cannot be enabled\\n\\nThe workqueue is enabled when the appropriate driver is loaded and\\ndisabled when the driver is removed. When the driver is removed it\\nassumes that the workqueue was enabled successfully and proceeds to\\nfree allocations made during workqueue enabling.\\n\\nFailure during workqueue enabling does not prevent the driver from\\nbeing loaded. This is because the error path within drv_enable_wq()\\nreturns success unless a second failure is encountered\\nduring the error path. By returning success it is possible to load\\nthe driver even if the workqueue cannot be enabled and\\nallocations that do not exist are attempted to be freed during\\ndriver remove.\\n\\nSome examples of problematic flows:\\n(a)\\n\\n idxd_dmaengine_drv_probe() -\u003e drv_enable_wq() -\u003e idxd_wq_request_irq():\\n In above flow, if idxd_wq_request_irq() fails then\\n idxd_wq_unmap_portal() is called on error exit path, but\\n drv_enable_wq() returns 0 because idxd_wq_disable() succeeds. The\\n driver is thus loaded successfully.\\n\\n idxd_dmaengine_drv_remove()-\u003edrv_disable_wq()-\u003eidxd_wq_unmap_portal()\\n Above flow on driver unload triggers the WARN in devm_iounmap() because\\n the device resource has already been removed during error path of\\n drv_enable_wq().\\n\\n(b)\\n\\n idxd_dmaengine_drv_probe() -\u003e drv_enable_wq() -\u003e idxd_wq_request_irq():\\n In above flow, if idxd_wq_request_irq() fails then\\n idxd_wq_init_percpu_ref() is never called to initialize the percpu\\n counter, yet the driver loads successfully because drv_enable_wq()\\n returns 0.\\n\\n idxd_dmaengine_drv_remove()-\u003e__idxd_wq_quiesce()-\u003epercpu_ref_kill():\\n Above flow on driver unload triggers a BUG when attempting to drop the\\n initial ref of the uninitialized percpu ref:\\n BUG: kernel NULL pointer dereference, address: 0000000000000010\\n\\nFix the drv_enable_wq() error path by returning the original error that\\nindicates failure of workqueue enabling. This ensures that the probe\\nfails when an error is encountered and the driver remove paths are only\\nattempted when the workqueue was enabled successfully.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: dmaengine: idxd: permite que la sonda falle cuando no se puede habilitar la cola de trabajo. La cola de trabajo se habilita cuando se carga el controlador apropiado y se deshabilita cuando se elimina el controlador. Cuando se elimina el controlador, se supone que la cola de trabajo se habilit\u00f3 correctamente y procede a liberar las asignaciones realizadas durante la habilitaci\u00f3n de la cola de trabajo. La falla durante la habilitaci\u00f3n de la cola de trabajo no impide que se cargue el controlador. Esto se debe a que la ruta de error dentro de drv_enable_wq() devuelve \u00e9xito a menos que se encuentre una segunda falla durante la ruta de error. Al devolver el \u00e9xito, es posible cargar el controlador incluso si no se puede habilitar la cola de trabajo y se intenta liberar las asignaciones que no existen durante la eliminaci\u00f3n del controlador. Algunos ejemplos de flujos problem\u00e1ticos: (a) idxd_dmaengine_drv_probe() -\u0026gt; drv_enable_wq() -\u0026gt; idxd_wq_request_irq(): en el flujo anterior, si idxd_wq_request_irq() falla, se llama a idxd_wq_unmap_portal() en la ruta de salida de error, pero drv_enable_wq() devuelve 0 porque idxd_wq_disable() tiene \u00e9xito. De este modo, el controlador se carga correctamente. idxd_dmaengine_drv_remove()-\u0026gt;drv_disable_wq()-\u0026gt;idxd_wq_unmap_portal() El flujo anterior al descargar el controlador activa la ADVERTENCIA en devm_iounmap() porque el recurso del dispositivo ya se elimin\u00f3 durante la ruta de error de drv_enable_wq(). (b) idxd_dmaengine_drv_probe() -\u0026gt; drv_enable_wq() -\u0026gt; idxd_wq_request_irq(): en el flujo anterior, si idxd_wq_request_irq() falla, nunca se llama a idxd_wq_init_percpu_ref() para inicializar el contador de percpu, pero el controlador se carga correctamente porque drv_enable_wq() devuelve 0 idxd_dmaengine_drv_remove()-\u0026gt;__idxd_wq_quiesce()-\u0026gt;percpu_ref_kill(): El flujo anterior en la descarga del controlador desencadena un ERROR al intentar eliminar la referencia inicial de la referencia percpu no inicializada: ERROR: desreferencia del puntero NULL del kernel, direcci\u00f3n: 0000000000000010 Corrija el drv_enable_wq(. ) ruta de error al devolver el error original que indica un error al habilitar la cola de trabajo. Esto garantiza que la sonda falle cuando se encuentre un error y que las rutas de eliminaci\u00f3n del controlador solo se intenten cuando la cola de trabajo se habilit\u00f3 correctamente.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15\",\"versionEndExcluding\":\"5.15.90\",\"matchCriteriaId\":\"B8218B10-56F1-42B3-B9DF-75A2D3864D3E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.8\",\"matchCriteriaId\":\"A6AFE6C9-3F59-4711-B2CF-7D6682FF6BD0\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0f150134dd795ffcd60b798a85ab737d8d010fb7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/99dc4520b74e7ca8e9dc9abe37a0b10b49467960\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b51b75f0604f17c0f6f3b6f68f1a521a5cc6b04f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.