CVE-2022-49765

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-49765
In the Linux kernel, the following vulnerability has been resolved: net/9p: use a dedicated spinlock for trans_fd Shamelessly copying the explanation from Tetsuo Handa's suggested patch[1] (slightly reworded): syzbot is reporting inconsistent lock state in p9_req_put()[2], for p9_tag_remove() from p9_req_put() from IRQ context is using spin_lock_irqsave() on "struct p9_client"->lock but trans_fd (not from IRQ context) is using spin_lock(). Since the locks actually protect different things in client.c and in trans_fd.c, just replace trans_fd.c's lock by a new one specific to the transport (client.c's protect the idr for fid/tag allocations, while trans_fd.c's protects its own req list and request status field that acts as the transport's state machine)

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/296ab4a813841ba1d5f40b03190fd1bd8f25aab0 Patch
https://git.kernel.org/stable/c/43bbadb7e4636dc02f6a283c2a39e6438e6173cd Patch
https://git.kernel.org/stable/c/717b9b4f38703d7f5293059e3a242d16f76fa045 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

06 Nov 2025, 21:58

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/296ab4a813841ba1d5f40b03190fd1bd8f25aab0 - () https://git.kernel.org/stable/c/296ab4a813841ba1d5f40b03190fd1bd8f25aab0 - Patch
References () https://git.kernel.org/stable/c/43bbadb7e4636dc02f6a283c2a39e6438e6173cd - () https://git.kernel.org/stable/c/43bbadb7e4636dc02f6a283c2a39e6438e6173cd - Patch
References () https://git.kernel.org/stable/c/717b9b4f38703d7f5293059e3a242d16f76fa045 - () https://git.kernel.org/stable/c/717b9b4f38703d7f5293059e3a242d16f76fa045 - Patch
First Time Linux
Linux linux Kernel
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/9p: uso de un spinlock dedicado para trans_fd. Copiando descaradamente la explicación del parche sugerido por Tetsuo Handa[1] (ligeramente reformulada): syzbot reporta un estado de bloqueo inconsistente en p9_req_put()[2], para p9_tag_remove() desde p9_req_put() desde el contexto IRQ, se usa spin_lock_irqsave() en "struct p9_client"->lock, pero trans_fd (no desde el contexto IRQ) usa spin_lock(). Dado que los bloqueos protegen elementos diferentes en client.c y en trans_fd.c, simplemente reemplace el bloqueo de trans_fd.c por uno nuevo específico para el transporte (el de client.c protege el IDR para las asignaciones de FID/etiqueta, mientras que el de trans_fd.c protege su propia lista de solicitudes y el campo de estado de la solicitud, que actúa como la máquina de estados del transporte).
CWE CWE-667

01 May 2025, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-01 15:15

Updated : 2025-11-06 21:58

NVD link : CVE-2022-49765

Mitre link : CVE-2022-49765

CVE.ORG link : CVE-2022-49765

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-667

Improper Locking