CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2022-48862 – vhost: fix hung thread due to erroneous iotlb entries
https://notcve.org/view.php?id=CVE-2022-48862
In the Linux kernel, the following vulnerability has been resolved: vhost: fix hung thread due to erroneous iotlb entries In vhost_iotlb_add_range_ctx(), range size can overflow to 0 when start is 0 and last is ULONG_MAX. One instance where it can happen is when userspace sends an IOTLB message with iova=size=uaddr=0 (vhost_process_iotlb_msg). So, an entry with size = 0, start = 0, last = ULONG_MAX ends up in the iotlb. Next time a packet is sent, iotlb_access_ok() loops indefinitely due to that erroneous entry. Call Trace: <TASK> iotlb_access_ok+0x21b/0x3e0 drivers/vhost/vhost.c:1340 vq_meta_prefetch+0xbc/0x280 drivers/vhost/vhost.c:1366 vhost_transport_do_send_pkt+0xe0/0xfd0 drivers/vhost/vsock.c:104 vhost_worker+0x23d/0x3d0 drivers/vhost/vhost.c:372 kthread+0x2e9/0x3a0 kernel/kthread.c:377 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 </TASK> Reported by syzbot at: https://syzkaller.appspot.com/bug?extid=0abd373e2e50d704db87 To fix this, do two things: 1. • https://git.kernel.org/stable/c/0bbe30668d89ec8a309f28ced6d092c90fb23e8c https://git.kernel.org/stable/c/f8d88e86e90ea1002226d7ac2430152bfea003d1 https://git.kernel.org/stable/c/d9a747e6b6561280bf1791bb24c5e9e082193dad https://git.kernel.org/stable/c/e2ae38cf3d91837a493cb2093c87700ff3cbe667 • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2022-48861 – vdpa: fix use-after-free on vp_vdpa_remove
https://notcve.org/view.php?id=CVE-2022-48861
In the Linux kernel, the following vulnerability has been resolved: vdpa: fix use-after-free on vp_vdpa_remove When vp_vdpa driver is unbind, vp_vdpa is freed in vdpa_unregister_device and then vp_vdpa->mdev.pci_dev is dereferenced in vp_modern_remove, triggering use-after-free. Call Trace of unbinding driver free vp_vdpa : do_syscall_64 vfs_write kernfs_fop_write_iter device_release_driver_internal pci_device_remove vp_vdpa_remove vdpa_unregister_device kobject_release device_release kfree Call Trace of dereference vp_vdpa->mdev.pci_dev: vp_modern_remove pci_release_selected_regions pci_release_region pci_resource_len pci_resource_end (dev)->resource[(bar)].end En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: vdpa: corrige el use-after-free en vp_vdpa_remove Cuando el controlador vp_vdpa se desvincula, se libera vp_vdpa en vdpa_unregister_device y luego se elimina la referencia a vp_vdpa->mdev.pci_dev en vp_modern_remove, lo que activa el use-after-free. Rastreo de llamadas de controlador de desvinculación gratuito vp_vdpa: do_syscall_64 vfs_write kernfs_fop_write_iter device_release_driver_internal pci_device_remove vp_vdpa_remove vdpa_unregister_device kobject_release device_release kfree Rastreo de llamadas de desreferencia vp_vdpa->mdev.pci_dev: vp_modern_remove p ci_release_selected_regions pci_release_region pci_resource_len pci_resource_end (dev)->resource[(bar)].end • https://git.kernel.org/stable/c/64b9f64f80a6f4b7ea51bf0510119cb15e801dc6 https://git.kernel.org/stable/c/4b1743bc715a3691a63ac21b349079b07bf1b19e https://git.kernel.org/stable/c/dc54ba9932aeaaa1a21fe214af1f446593a78274 https://git.kernel.org/stable/c/eb057b44dbe35ae14527830236a92f51de8f9184 • CWE-416: Use After Free •
CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 0CVE-2022-48860 – ethernet: Fix error handling in xemaclite_of_probe
https://notcve.org/view.php?id=CVE-2022-48860
In the Linux kernel, the following vulnerability has been resolved: ethernet: Fix error handling in xemaclite_of_probe This node pointer is returned by of_parse_phandle() with refcount incremented in this function. Calling of_node_put() to avoid the refcount leak. As the remove function do. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ethernet: corrige el manejo de errores en xemaclite_of_probe Este puntero de nodo lo devuelve of_parse_phandle() con refcount incrementado en esta función. Llamar a of_node_put() para evitar la fuga de recuento. • https://git.kernel.org/stable/c/5cdaaa12866e916d0ada8b56c5f0e543cfc7fe3d https://git.kernel.org/stable/c/669172ce976608b25a2f76f3c65d47f042d125c9 https://git.kernel.org/stable/c/b7220f8e9d6c6b9594ddfb3125dad938cd478b1f https://git.kernel.org/stable/c/8609e29611befc4bfbe7a91bb50fc65ae72ff549 https://git.kernel.org/stable/c/8ee065a7a9b6a3976c16340503677efc4d8351f6 https://git.kernel.org/stable/c/979b418b96e35f07136f77962ccfaa54cf3e30e1 https://git.kernel.org/stable/c/5e7c402892e189a7bc152b125e72261154aa585d https://git.kernel.org/stable/c/1852854ee349881efb78ccdbbb2378389 • CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2022-48859 – net: marvell: prestera: Add missing of_node_put() in prestera_switch_set_base_mac_addr
https://notcve.org/view.php?id=CVE-2022-48859
In the Linux kernel, the following vulnerability has been resolved: net: marvell: prestera: Add missing of_node_put() in prestera_switch_set_base_mac_addr This node pointer is returned by of_find_compatible_node() with refcount incremented. Calling of_node_put() to aovid the refcount leak. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: marvell: prestera: Agregar falta of_node_put() en prestera_switch_set_base_mac_addr Este puntero de nodo lo devuelve of_find_compatible_node() con refcount incrementado. Llamar a of_node_put() para evitar la fuga de recuento. • https://git.kernel.org/stable/c/501ef3066c89d7f9045315e1be58749cf9e6814d https://git.kernel.org/stable/c/b7c2fd1d126329340639adfb8dd2938fe4b65df7 https://git.kernel.org/stable/c/4cc66bf17220ff9631f9fa99b02a872e0ad5a08b https://git.kernel.org/stable/c/c9ffa3e2bc451816ce0295e40063514fabf2bd36 • CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 7.0EPSS: 0%CPEs: 6EXPL: 0CVE-2022-48858 – net/mlx5: Fix a race on command flush flow
https://notcve.org/view.php?id=CVE-2022-48858
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix a race on command flush flow Fix a refcount use after free warning due to a race on command entry. Such race occurs when one of the commands releases its last refcount and frees its index and entry while another process running command flush flow takes refcount to this command entry. The process which handles commands flush may see this command as needed to be flushed if the other process released its refcount but didn't release the index yet. Fix it by adding the needed spin lock. It fixes the following warning trace: refcount_t: addition on 0; use-after-free. WARNING: CPU: 11 PID: 540311 at lib/refcount.c:25 refcount_warn_saturate+0x80/0xe0 ... RIP: 0010:refcount_warn_saturate+0x80/0xe0 ... Call Trace: <TASK> mlx5_cmd_trigger_completions+0x293/0x340 [mlx5_core] mlx5_cmd_flush+0x3a/0xf0 [mlx5_core] enter_error_state+0x44/0x80 [mlx5_core] mlx5_fw_fatal_reporter_err_work+0x37/0xe0 [mlx5_core] process_one_work+0x1be/0x390 worker_thread+0x4d/0x3d0 ? rescuer_thread+0x350/0x350 kthread+0x141/0x160 ? set_kthread_struct+0x40/0x40 ret_from_fork+0x1f/0x30 </TASK> En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/mlx5: Corregir una ejecución en el flujo de descarga de comandos. • https://git.kernel.org/stable/c/073fff8102062cd675170ceb54d90da22fe7e668 https://git.kernel.org/stable/c/50b2412b7e7862c5af0cbf4b10d93bc5c712d021 https://git.kernel.org/stable/c/da87ea137373689dec9d3fafa34a57787320a4b3 https://git.kernel.org/stable/c/1a4017926eeea56c7540cc41b42106746ee8a0ee https://git.kernel.org/stable/c/f3331bc17449f15832c31823f27573f4c0e13e5f https://git.kernel.org/stable/c/7c519f769f555ff7d9d4ccba3497bbb589df360a https://git.kernel.org/stable/c/0401bfb27a91d7bdd74b1635c1aae57cbb128da6 https://git.kernel.org/stable/c/063bd355595428750803d8736a9bb7c8d • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-416: Use After Free •