CVE-2022-48914

一、漏洞信息
 漏洞编号：[CVE-2022-48914](https://nvd.nist.gov/vuln/detail/CVE-2022-48914)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：5.5 Medium
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:xen/netfront: destroy queues before real_num_tx_queues is zeroedxennet_destroy_queues() relies on info->netdev->real_num_tx_queues todelete queues. Since d7dac083414eb5bb99a6d2ed53dc2c1b405224e5( net-sysfs: update the queue counts in the unregistration path ),unregister_netdev() indirectly sets real_num_tx_queues to 0. Those twofacts together means, that xennet_destroy_queues() called fromxennet_remove() cannot do its job, because it s called afterunregister_netdev(). This results in kfree-ing queues that are stilllinked in napi, which ultimately crashes:    BUG: kernel NULL pointer dereference, address: 0000000000000000    #PF: supervisor read access in kernel mode    #PF: error_code(0x0000) - not-present page    PGD 0 P4D 0    Oops: 0000 [#1] PREEMPT SMP PTI    CPU: 1 PID: 52 Comm: xenwatch Tainted: G        W         5.16.10-1.32.fc32.qubes.x86_64+ #226    RIP: 0010:free_netdev+0xa3/0x1a0    Code: ff 48 89 df e8 2e e9 00 00 48 8b 43 50 48 8b 08 48 8d b8 a0 fe ff ff 48 8d a9 a0 fe ff ff 49 39 c4 75 26 eb 47 e8 ed c1 66 ff <48> 8b 85 60 01 00 00 48 8d 95 60 01 00 00 48 89 ef 48 2d 60 01 00    RSP: 0000:ffffc90000bcfd00 EFLAGS: 00010286    RAX: 0000000000000000 RBX: ffff88800edad000 RCX: 0000000000000000    RDX: 0000000000000001 RSI: ffffc90000bcfc30 RDI: 00000000ffffffff    RBP: fffffffffffffea0 R08: 0000000000000000 R09: 0000000000000000    R10: 0000000000000000 R11: 0000000000000001 R12: ffff88800edad050    R13: ffff8880065f8f88 R14: 0000000000000000 R15: ffff8880066c6680    FS:  0000000000000000(0000) GS:ffff8880f3300000(0000) knlGS:0000000000000000    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033    CR2: 0000000000000000 CR3: 00000000e998c006 CR4: 00000000003706e0    Call Trace:     <TASK>     xennet_remove+0x13d/0x300 [xen_netfront]     xenbus_dev_remove+0x6d/0xf0     __device_release_driver+0x17a/0x240     device_release_driver+0x24/0x30     bus_remove_device+0xd8/0x140     device_del+0x18b/0x410     ? _raw_spin_unlock+0x16/0x30     ? klist_iter_exit+0x14/0x20     ? xenbus_dev_request_and_reply+0x80/0x80     device_unregister+0x13/0x60     xenbus_dev_changed+0x18e/0x1f0     xenwatch_thread+0xc0/0x1a0     ? do_wait_intr_irq+0xa0/0xa0     kthread+0x16b/0x190     ? set_kthread_struct+0x40/0x40     ret_from_fork+0x22/0x30     </TASK>Fix this by calling xennet_destroy_queues() from xennet_uninit(),when real_num_tx_queues is still available. This ensures that queues aredestroyed when real_num_tx_queues is set to 0, regardless of howunregister_netdev() was called.Originally reported athttps://github.com/QubesOS/qubes-issues/issues/7257
 漏洞公开时间：2024-08-22 10:15:05
 漏洞创建时间：2024-08-22 20:15:07
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2022-48914
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/198cdc287769c717dafff5887c6125cb7a373bf3 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/47e2f166ed9fe17f24561d6315be2228f6a90209 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/a1753d5c29a6fb9a8966dcf04cb4f3b71e303ae8 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/a63eb1e4a2e1a191a90217871e67fba42fd39255 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/b40c912624775a21da32d1105e158db5f6d0554a |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/dcf4ff7a48e7598e6b10126cc02177abb8ae4f3f |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-48914 | https://bugzilla.suse.com/show_bug.cgi?id=1229642 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2022-48914 | https://bugzilla.suse.com/show_bug.cgi?id=1229642 |
| suse_bugzilla | https://git.kernel.org/stable/c/198cdc287769c717dafff5887c6125cb7a373bf3 | https://bugzilla.suse.com/show_bug.cgi?id=1229642 |
| suse_bugzilla | https://git.kernel.org/stable/c/47e2f166ed9fe17f24561d6315be2228f6a90209 | https://bugzilla.suse.com/show_bug.cgi?id=1229642 |
| suse_bugzilla | https://git.kernel.org/stable/c/a1753d5c29a6fb9a8966dcf04cb4f3b71e303ae8 | https://bugzilla.suse.com/show_bug.cgi?id=1229642 |
| suse_bugzilla | https://git.kernel.org/stable/c/a63eb1e4a2e1a191a90217871e67fba42fd39255 | https://bugzilla.suse.com/show_bug.cgi?id=1229642 |
| suse_bugzilla | https://git.kernel.org/stable/c/b40c912624775a21da32d1105e158db5f6d0554a | https://bugzilla.suse.com/show_bug.cgi?id=1229642 |
| suse_bugzilla | https://git.kernel.org/stable/c/dcf4ff7a48e7598e6b10126cc02177abb8ae4f3f | https://bugzilla.suse.com/show_bug.cgi?id=1229642 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2022/CVE-2022-48914.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1229642 |
| ubuntu | https://www.cve.org/CVERecord?id=CVE-2022-48914 | https://ubuntu.com/security/CVE-2022-48914 |
| ubuntu | https://git.kernel.org/linus/dcf4ff7a48e7598e6b10126cc02177abb8ae4f3f (5.17-rc7) | https://ubuntu.com/security/CVE-2022-48914 |
| ubuntu | https://git.kernel.org/stable/c/198cdc287769c717dafff5887c6125cb7a373bf3 | https://ubuntu.com/security/CVE-2022-48914 |
| ubuntu | https://git.kernel.org/stable/c/b40c912624775a21da32d1105e158db5f6d0554a | https://ubuntu.com/security/CVE-2022-48914 |
| ubuntu | https://git.kernel.org/stable/c/a1753d5c29a6fb9a8966dcf04cb4f3b71e303ae8 | https://ubuntu.com/security/CVE-2022-48914 |
| ubuntu | https://git.kernel.org/stable/c/a63eb1e4a2e1a191a90217871e67fba42fd39255 | https://ubuntu.com/security/CVE-2022-48914 |
| ubuntu | https://git.kernel.org/stable/c/47e2f166ed9fe17f24561d6315be2228f6a90209 | https://ubuntu.com/security/CVE-2022-48914 |
| ubuntu | https://git.kernel.org/stable/c/dcf4ff7a48e7598e6b10126cc02177abb8ae4f3f | https://ubuntu.com/security/CVE-2022-48914 |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2022-48914 | https://ubuntu.com/security/CVE-2022-48914 |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2022-48914 | https://ubuntu.com/security/CVE-2022-48914 |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2022-48914 | https://ubuntu.com/security/CVE-2022-48914 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://git.kernel.org/stable/c/198cdc287769c717dafff5887c6125cb7a373bf3 |  | nvd |
|  |  | https://git.kernel.org/stable/c/47e2f166ed9fe17f24561d6315be2228f6a90209 |  | nvd |
|  |  | https://git.kernel.org/stable/c/a1753d5c29a6fb9a8966dcf04cb4f3b71e303ae8 |  | nvd |
|  |  | https://git.kernel.org/stable/c/a63eb1e4a2e1a191a90217871e67fba42fd39255 |  | nvd |
|  |  | https://git.kernel.org/stable/c/b40c912624775a21da32d1105e158db5f6d0554a |  | nvd |
|  |  | https://git.kernel.org/stable/c/dcf4ff7a48e7598e6b10126cc02177abb8ae4f3f |  | nvd |
| linux |  | https://git.kernel.org/linus/dcf4ff7a48e7598e6b10126cc02177abb8ae4f3f | https://git.kernel.org/linus/d7dac083414eb5bb99a6d2ed53dc2c1b405224e5 | ubuntu |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
    In the Linux kernel, the following vulnerability has been resolved:xen/netfront: destroy queues before real_num_tx_queues is zeroedxennet_destroy_queues() relies on info->netdev->real_num_tx_queues todelete queues. Since d7dac083414eb5bb99a6d2ed53dc2c1b405224e5( net-sysfs: update the queue counts in the unregistration path ),unregister_netdev() indirectly sets real_num_tx_queues to 0. Those twofacts together means, that xennet_destroy_queues() called fromxennet_remove() cannot do its job, because it s called afterunregister_netdev(). This results in kfree-ing queues that are stilllinked in napi, which ultimately crashes:    BUG: kernel NULL pointer dereference, address: 0000000000000000    #PF: supervisor read access in kernel mode    #PF: error_code(0x0000) - not-present page    PGD 0 P4D 0    Oops: 0000 [#1] PREEMPT SMP PTI    CPU: 1 PID: 52 Comm: xenwatch Tainted: G        W         5.16.10-1.32.fc32.qubes.x86_64+ #226    RIP: 0010:free_netdev+0xa3/0x1a0    Code: ff 48 89 df e8 2e e9 00 00 48 8b 43 50 48 8b 08 48 8d b8 a0 fe ff ff 48 8d a9 a0 fe ff ff 49 39 c4 75 26 eb 47 e8 ed c1 66 ff <48> 8b 85 60 01 00 00 48 8d 95 60 01 00 00 48 89 ef 48 2d 60 01 00    RSP: 0000:ffffc90000bcfd00 EFLAGS: 00010286    RAX: 0000000000000000 RBX: ffff88800edad000 RCX: 0000000000000000    RDX: 0000000000000001 RSI: ffffc90000bcfc30 RDI: 00000000ffffffff    RBP: fffffffffffffea0 R08: 0000000000000000 R09: 0000000000000000    R10: 0000000000000000 R11: 0000000000000001 R12: ffff88800edad050    R13: ffff8880065f8f88 R14: 0000000000000000 R15: ffff8880066c6680    FS:  0000000000000000(0000) GS:ffff8880f3300000(0000) knlGS:0000000000000000    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033    CR2: 0000000000000000 CR3: 00000000e998c006 CR4: 00000000003706e0    Call Trace:     <TASK>     xennet_remove+0x13d/0x300 [xen_netfront]     xenbus_dev_remove+0x6d/0xf0     __device_release_driver+0x17a/0x240     device_release_driver+0x24/0x30     bus_remove_device+0xd8/0x140     device_del+0x18b/0x410     ? _raw_spin_unlock+0x16/0x30     ? klist_iter_exit+0x14/0x20     ? xenbus_dev_request_and_reply+0x80/0x80     device_unregister+0x13/0x60     xenbus_dev_changed+0x18e/0x1f0     xenwatch_thread+0xc0/0x1a0     ? do_wait_intr_irq+0xa0/0xa0     kthread+0x16b/0x190     ? set_kthread_struct+0x40/0x40     ret_from_fork+0x22/0x30     </TASK>Fix this by calling xennet_destroy_queues() from xennet_uninit(),when real_num_tx_queues is still available. This ensures that queues aredestroyed when real_num_tx_queues is set to 0, regardless of howunregister_netdev() was called.Originally reported athttps://github.com/QubesOS/qubes-issues/issues/7257 
 openEuler评分：
  5.5
 Vector：CVSS：2.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(4.19.90):受影响
2.openEuler-22.03-LTS-SP1(5.10.0):不受影响
3.openEuler-22.03-LTS-SP3(5.10.0):不受影响
4.openEuler-22.03-LTS-SP4(5.10.0):不受影响
5.master(6.6.0):不受影响
6.openEuler-24.03-LTS(6.6.0):不受影响
7.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1(5.10.0):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.master(6.6.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-22.03-LTS-SP4(5.10.0):否

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2024-2122

src-openEuler/kernel
Closed

Content Risk Flag

Comments (18)

src-openEuler/kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2022-48914

Comments (18)

Search

src-openEuler/kernel
Closed