CVE-2022-48666 scsi: core: Fix a use-after-free

2024-04-2813:01:50

Linux

github.com

linux kernel

scsi

use-after-free

AI Score

6.9

Confidence

Low

EPSS

Percentile

16.1%

SSVC

Exploitation

none

Automatable

Technical Impact

total

JSON

In the Linux kernel, the following vulnerability has been resolved:

scsi: core: Fix a use-after-free

There are two .exit_cmd_priv implementations. Both implementations use
resources associated with the SCSI host. Make sure that these resources are
still available when .exit_cmd_priv is called by waiting inside
scsi_remove_host() until the tag set has been freed.

This commit fixes the following use-after-free:

==================================================================
BUG: KASAN: use-after-free in srp_exit_cmd_priv+0x27/0xd0 [ib_srp]
Read of size 8 at addr ffff888100337000 by task multipathd/16727
Call Trace:
<TASK>
dump_stack_lvl+0x34/0x44
print_report.cold+0x5e/0x5db
kasan_report+0xab/0x120
srp_exit_cmd_priv+0x27/0xd0 [ib_srp]
scsi_mq_exit_request+0x4d/0x70
blk_mq_free_rqs+0x143/0x410
__blk_mq_free_map_and_rqs+0x6e/0x100
blk_mq_free_tag_set+0x2b/0x160
scsi_host_dev_release+0xf3/0x1a0
device_release+0x54/0xe0
kobject_put+0xa5/0x120
device_release+0x54/0xe0
kobject_put+0xa5/0x120
scsi_device_dev_release_usercontext+0x4c1/0x4e0
execute_in_process_context+0x23/0x90
device_release+0x54/0xe0
kobject_put+0xa5/0x120
scsi_disk_release+0x3f/0x50
device_release+0x54/0xe0
kobject_put+0xa5/0x120
disk_release+0x17f/0x1b0
device_release+0x54/0xe0
kobject_put+0xa5/0x120
dm_put_table_device+0xa3/0x160 [dm_mod]
dm_put_device+0xd0/0x140 [dm_mod]
free_priority_group+0xd8/0x110 [dm_multipath]
free_multipath+0x94/0xe0 [dm_multipath]
dm_table_destroy+0xa2/0x1e0 [dm_mod]
__dm_destroy+0x196/0x350 [dm_mod]
dev_remove+0x10c/0x160 [dm_mod]
ctl_ioctl+0x2c2/0x590 [dm_mod]
dm_ctl_ioctl+0x5/0x10 [dm_mod]
__x64_sys_ioctl+0xb4/0xf0
dm_ctl_ioctl+0x5/0x10 [dm_mod]
__x64_sys_ioctl+0xb4/0xf0
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x46/0xb0

CNA Affected

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "65ca846a5314",
        "lessThan": "5ce8fad94123",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "65ca846a5314",
        "lessThan": "f818708eeeae",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "65ca846a5314",
        "lessThan": "2e7eb4c1e8af",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "65ca846a5314",
        "lessThan": "8fe4ce5836e9",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "drivers/scsi/hosts.c",
      "drivers/scsi/scsi_lib.c",
      "drivers/scsi/scsi_priv.h",
      "drivers/scsi/scsi_scan.c",
      "drivers/scsi/scsi_sysfs.c",
      "include/scsi/scsi_host.h"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "5.7"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "5.7",
        "versionType": "custom"
      },
      {
        "status": "unaffected",
        "version": "5.10.223",
        "versionType": "custom",
        "lessThanOrEqual": "5.10.*"
      },
      {
        "status": "unaffected",
        "version": "5.15.164",
        "versionType": "custom",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "5.19.12",
        "versionType": "custom",
        "lessThanOrEqual": "5.19.*"
      },
      {
        "status": "unaffected",
        "version": "6.0",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "drivers/scsi/hosts.c",
      "drivers/scsi/scsi_lib.c",
      "drivers/scsi/scsi_priv.h",
      "drivers/scsi/scsi_scan.c",
      "drivers/scsi/scsi_sysfs.c",
      "include/scsi/scsi_host.h"
    ],
    "defaultStatus": "affected"
  }
]

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:o:linux:linux_kernel:5.7:*:*:*:*:*:*:*"
    ],
    "vendor": "linux",
    "product": "linux_kernel",
    "versions": [
      {
        "status": "affected",
        "version": "5.7"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
    ],
    "vendor": "linux",
    "product": "linux_kernel",
    "versions": [
      {
        "status": "affected",
        "version": "65ca846a5314",
        "lessThan": "2e7eb4c1e8af",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]