CVE-2022-48751

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-48751
In the Linux kernel, the following vulnerability has been resolved: net/smc: Transitional solution for clcsock race issue We encountered a crash in smc_setsockopt() and it is caused by accessing smc->clcsock after clcsock was released. BUG: kernel NULL pointer dereference, address: 0000000000000020 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 1 PID: 50309 Comm: nginx Kdump: loaded Tainted: G E 5.16.0-rc4+ #53 RIP: 0010:smc_setsockopt+0x59/0x280 [smc] Call Trace: <TASK> __sys_setsockopt+0xfc/0x190 __x64_sys_setsockopt+0x20/0x30 do_syscall_64+0x34/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f16ba83918e </TASK> This patch tries to fix it by holding clcsock_release_lock and checking whether clcsock has already been released before access. In case that a crash of the same reason happens in smc_getsockopt() or smc_switch_to_fallback(), this patch also checkes smc->clcsock in them too. And the caller of smc_switch_to_fallback() will identify whether fallback succeeds according to the return value.

4.7 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.0 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/38f0bdd548fd2ef5d481b88d8a2bfef968452e34 Patch
https://git.kernel.org/stable/c/4284225cd8001e134f5cf533a7cd244bbb654d0f Patch
https://git.kernel.org/stable/c/c0bf3d8a943b6f2e912b7c1de03e2ef28e76f760 Patch
https://git.kernel.org/stable/c/38f0bdd548fd2ef5d481b88d8a2bfef968452e34 Patch
https://git.kernel.org/stable/c/4284225cd8001e134f5cf533a7cd244bbb654d0f Patch
https://git.kernel.org/stable/c/c0bf3d8a943b6f2e912b7c1de03e2ef28e76f760 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.17:rc1:*:*:*:*:*:*
History

06 Jan 2025, 21:47

Type Values Removed Values Added
CWE CWE-476
First Time Linux linux Kernel
Linux
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.7
References () https://git.kernel.org/stable/c/38f0bdd548fd2ef5d481b88d8a2bfef968452e34 - () https://git.kernel.org/stable/c/38f0bdd548fd2ef5d481b88d8a2bfef968452e34 - Patch
References () https://git.kernel.org/stable/c/4284225cd8001e134f5cf533a7cd244bbb654d0f - () https://git.kernel.org/stable/c/4284225cd8001e134f5cf533a7cd244bbb654d0f - Patch
References () https://git.kernel.org/stable/c/c0bf3d8a943b6f2e912b7c1de03e2ef28e76f760 - () https://git.kernel.org/stable/c/c0bf3d8a943b6f2e912b7c1de03e2ef28e76f760 - Patch
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.17:rc1:*:*:*:*:*:*

21 Nov 2024, 07:33

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: net/smc: solución transitoria para el problema de ejecución de clcsock Encontramos un bloqueo en smc_setsockopt() y se debe al acceso a smc-&gt;clcsock después de que se lanzó clcsock. ERROR: desreferencia del puntero NULL del kernel, dirección: 0000000000000020 #PF: acceso de lectura del supervisor en modo kernel #PF: código_error(0x0000) - página no presente PGD 0 P4D 0 Ups: 0000 [#1] PREEMPT SMP PTI CPU: 1 PID: 50309 Comm: nginx Kdump: cargado Contaminado: GE 5.16.0-rc4+ #53 RIP: 0010:smc_setsockopt+0x59/0x280 [smc] Seguimiento de llamadas: __sys_setsockopt+0xfc/0x190 __x64_sys_setsockopt+0x20/0x30 do_syscall_64+0x34/0x90 Entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f16ba83918e Este parche intenta solucionarlo manteniendo presionado clcsock_release_lock y verificando si clcsock ya se ha liberado antes del acceso. En caso de que ocurra una falla por el mismo motivo en smc_getsockopt() o smc_switch_to_fallback(), este parche también verifica smc-&gt;clcsock en ellos. Y la persona que llama a smc_switch_to_fallback() identificará si el respaldo tiene éxito de acuerdo con el valor de retorno.
References () https://git.kernel.org/stable/c/38f0bdd548fd2ef5d481b88d8a2bfef968452e34 - () https://git.kernel.org/stable/c/38f0bdd548fd2ef5d481b88d8a2bfef968452e34 -
References () https://git.kernel.org/stable/c/4284225cd8001e134f5cf533a7cd244bbb654d0f - () https://git.kernel.org/stable/c/4284225cd8001e134f5cf533a7cd244bbb654d0f -
References () https://git.kernel.org/stable/c/c0bf3d8a943b6f2e912b7c1de03e2ef28e76f760 - () https://git.kernel.org/stable/c/c0bf3d8a943b6f2e912b7c1de03e2ef28e76f760 -

20 Jun 2024, 12:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-06-20 12:15

Updated : 2025-01-06 21:47

NVD link : CVE-2022-48751

Mitre link : CVE-2022-48751

CVE.ORG link : CVE-2022-48751

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-476

NULL Pointer Dereference