CVE-2022-48858
net/mlx5: Fix a race on command flush flow
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: Fix a race on command flush flow
Fix a refcount use after free warning due to a race on command entry.
Such race occurs when one of the commands releases its last refcount and
frees its index and entry while another process running command flush
flow takes refcount to this command entry. The process which handles
commands flush may see this command as needed to be flushed if the other
process released its refcount but didn't release the index yet. Fix it
by adding the needed spin lock.
It fixes the following warning trace:
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 11 PID: 540311 at lib/refcount.c:25 refcount_warn_saturate+0x80/0xe0
...
RIP: 0010:refcount_warn_saturate+0x80/0xe0
...
Call Trace:
<TASK>
mlx5_cmd_trigger_completions+0x293/0x340 [mlx5_core]
mlx5_cmd_flush+0x3a/0xf0 [mlx5_core]
enter_error_state+0x44/0x80 [mlx5_core]
mlx5_fw_fatal_reporter_err_work+0x37/0xe0 [mlx5_core]
process_one_work+0x1be/0x390
worker_thread+0x4d/0x3d0
? rescuer_thread+0x350/0x350
kthread+0x141/0x160
? set_kthread_struct+0x40/0x40
ret_from_fork+0x1f/0x30
</TASK>
En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/mlx5: Corregir una ejecución en el flujo de descarga de comandos. Corregir una advertencia de refcount use after free debido a una ejecución en la entrada de comandos. Dicha ejecución ocurre cuando uno de los comandos libera su último recuento y libera su índice y entrada, mientras que otro proceso que ejecuta el flujo de descarga de comandos toma el recuento de esta entrada de comando. El proceso que maneja los comandos de vaciado puede considerar que este comando es necesario para vaciarlo si el otro proceso publicó su recuento pero aún no publicó el índice. Solucionarlo agregando el bloqueo de giro necesario. Corrige el siguiente seguimiento de advertencia: refcount_t: adición en 0; use-after-free. ADVERTENCIA: CPU: 11 PID: 540311 en lib/refcount.c:25 refcount_warn_saturate+0x80/0xe0... RIP: 0010:refcount_warn_saturate+0x80/0xe0... Seguimiento de llamadas: mlx5_cmd_trigger_completions+0x293/0x340 [mlx5_core] mlx5_cmd_flush+0x3a/0xf0 [mlx5_core] enter_error_state+0x44/0x80 [mlx5_core] mlx5_fw_fatal_reporter_err_work+0x37/0xe0 [mlx5_core] Process_one_work+0x1be/0x390 trabajador_thread+0x4d/0x3d0 ? hilo_rescate+0x350/0x350 khilo+0x141/0x160 ? set_kthread_struct+0x40/0x40 ret_from_fork+0x1f/0x30
CVSS Scores
SSVC
- Decision:Track
Timeline
- 2024-07-16 CVE Reserved
- 2024-07-16 CVE Published
- 2024-07-24 EPSS Updated
- 2024-09-11 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
- CWE-416: Use After Free
CAPEC
References (8)
| URL | Tag | Source |
|---|---|---|
| https://git.kernel.org/stable/c/073fff8102062cd675170ceb54d90da22fe7e668 | Vuln. Introduced | |
| https://git.kernel.org/stable/c/50b2412b7e7862c5af0cbf4b10d93bc5c712d021 | Vuln. Introduced | |
| https://git.kernel.org/stable/c/da87ea137373689dec9d3fafa34a57787320a4b3 | Vuln. Introduced |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 5.4.71 < 5.4.185 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.4.71 < 5.4.185" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 5.9 < 5.10.106 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.9 < 5.10.106" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 5.9 < 5.15.29 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.9 < 5.15.29" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 5.9 < 5.16.15 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.9 < 5.16.15" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 5.9 < 5.17 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.9 < 5.17" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | 5.8.15 Search vendor "Linux" for product "Linux Kernel" and version "5.8.15" | en |
Affected
| ||||||