CVE-2022-48653

一、漏洞信息
 漏洞编号：[CVE-2022-48653](https://nvd.nist.gov/vuln/detail/CVE-2022-48653)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0
 CVSS V2.0分值：
  BaseScore：0.0 Low
  Vector：CVSS：2.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:ice: Don t double unplug aux on peer initiated resetIn the IDC callback that is accessed when the aux drivers request a reset,the function to unplug the aux devices is called.  This function is alsocalled in the ice_prepare_for_reset function. This double call is causinga  scheduling while atomic  BUG.[  662.676430] ice 0000:4c:00.0 rocep76s0: cqp opcode = 0x1 maj_err_code = 0xffff min_err_code = 0x8003[  662.676609] ice 0000:4c:00.0 rocep76s0: [Modify QP Cmd Error][op_code=8] status=-29 waiting=1 completion_err=1 maj=0xffff min=0x8003[  662.815006] ice 0000:4c:00.0 rocep76s0: ICE OICR event notification: oicr = 0x10000003[  662.815014] ice 0000:4c:00.0 rocep76s0: critical PE Error, GLPE_CRITERR=0x00011424[  662.815017] ice 0000:4c:00.0 rocep76s0: Requesting a reset[  662.815475] BUG: scheduling while atomic: swapper/37/0/0x00010002[  662.815475] BUG: scheduling while atomic: swapper/37/0/0x00010002[  662.815477] Modules linked in: rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs rfkill 8021q garp mrp stp llc vfat fat rpcrdma intel_rapl_msr intel_rapl_common sunrpc i10nm_edac rdma_ucm nfit ib_srpt libnvdimm ib_isert iscsi_target_mod x86_pkg_temp_thermal intel_powerclamp coretemp target_core_mod snd_hda_intel ib_iser snd_intel_dspcfg libiscsi snd_intel_sdw_acpi scsi_transport_iscsi kvm_intel iTCO_wdt rdma_cm snd_hda_codec kvm iw_cm ipmi_ssif iTCO_vendor_support snd_hda_core irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel snd_hwdep snd_seq snd_seq_device rapl snd_pcm snd_timer isst_if_mbox_pci pcspkr isst_if_mmio irdma intel_uncore idxd acpi_ipmi joydev isst_if_common snd mei_me idxd_bus ipmi_si soundcore i2c_i801 mei ipmi_devintf i2c_smbus i2c_ismt ipmi_msghandler acpi_power_meter acpi_pad rv(OE) ib_uverbs ib_cm ib_core xfs libcrc32c ast i2c_algo_bit drm_vram_helper drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm_ttm_helpe r ttm[  662.815546]  nvme nvme_core ice drm crc32c_intel i40e t10_pi wmi pinctrl_emmitsburg dm_mirror dm_region_hash dm_log dm_mod fuse[  662.815557] Preemption disabled at:[  662.815558] [<0000000000000000>] 0x0[  662.815563] CPU: 37 PID: 0 Comm: swapper/37 Kdump: loaded Tainted: G S         OE     5.17.1 #2[  662.815566] Hardware name: Intel Corporation D50DNP/D50DNP, BIOS SE5C6301.86B.6624.D18.2111021741 11/02/2021[  662.815568] Call Trace:[  662.815572]  <IRQ>[  662.815574]  dump_stack_lvl+0x33/0x42[  662.815581]  __schedule_bug.cold.147+0x7d/0x8a[  662.815588]  __schedule+0x798/0x990[  662.815595]  schedule+0x44/0xc0[  662.815597]  schedule_preempt_disabled+0x14/0x20[  662.815600]  __mutex_lock.isra.11+0x46c/0x490[  662.815603]  ? __ibdev_printk+0x76/0xc0 [ib_core][  662.815633]  device_del+0x37/0x3d0[  662.815639]  ice_unplug_aux_dev+0x1a/0x40 [ice][  662.815674]  ice_schedule_reset+0x3c/0xd0 [ice][  662.815693]  irdma_iidc_event_handler.cold.7+0xb6/0xd3 [irdma][  662.815712]  ? bitmap_find_next_zero_area_off+0x45/0xa0[  662.815719]  ice_send_event_to_aux+0x54/0x70 [ice][  662.815741]  ice_misc_intr+0x21d/0x2d0 [ice][  662.815756]  __handle_irq_event_percpu+0x4c/0x180[  662.815762]  handle_irq_event_percpu+0xf/0x40[  662.815764]  handle_irq_event+0x34/0x60[  662.815766]  handle_edge_irq+0x9a/0x1c0[  662.815770]  __common_interrupt+0x62/0x100[  662.815774]  common_interrupt+0xb4/0xd0[  662.815779]  </IRQ>[  662.815780]  <TASK>[  662.815780]  asm_common_interrupt+0x1e/0x40[  662.815785] RIP: 0010:cpuidle_enter_state+0xd6/0x380[  662.815789] Code: 49 89 c4 0f 1f 44 00 00 31 ff e8 65 d7 95 ff 45 84 ff 74 12 9c 58 f6 c4 02 0f 85 64 02 00 00 31 ff e8 ae c5 9c ff fb 45 85 f6 <0f> 88 12 01 00 00 49 63 d6 4c 2b 24 24 48 8d 04 52 48 8d 04 82 49[  662.815791] RSP: 0018:ff2c2c4f18edbe80 EFLAGS: 00000202[  662.815793] RAX: ff280805df140000 RBX: 0000000000000002 RCX: 000000000000001f[  662.815795] RDX: 0000009a52da2d08 R---truncated---
 漏洞公开时间：2024-04-28 21:15:07
 漏洞创建时间：2024-04-28 22:49:02
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2022-48653
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/149979e87eb7a365d3d0b259bed79d84ff585a93 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/23c619190318376769ad7b61504c2ea0703fb783 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/34447d64b8d28e4d6a73d73f07c879959d68fbfe |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-48653 | https://bugzilla.suse.com/show_bug.cgi?id=1223474 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2022-48653 | https://bugzilla.suse.com/show_bug.cgi?id=1223474 |
| suse_bugzilla | https://git.kernel.org/stable/c/149979e87eb7a365d3d0b259bed79d84ff585a93 | https://bugzilla.suse.com/show_bug.cgi?id=1223474 |
| suse_bugzilla | https://git.kernel.org/stable/c/23c619190318376769ad7b61504c2ea0703fb783 | https://bugzilla.suse.com/show_bug.cgi?id=1223474 |
| suse_bugzilla | https://git.kernel.org/stable/c/34447d64b8d28e4d6a73d73f07c879959d68fbfe | https://bugzilla.suse.com/show_bug.cgi?id=1223474 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2022/CVE-2022-48653.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1223474 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2024042858-CVE-2022-48653-b6e7@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2277809 |
| cve_search |  | https://git.kernel.org/stable/c/34447d64b8d28e4d6a73d73f07c879959d68fbfe |
| cve_search |  | https://git.kernel.org/stable/c/149979e87eb7a365d3d0b259bed79d84ff585a93 |
| cve_search |  | https://git.kernel.org/stable/c/23c619190318376769ad7b61504c2ea0703fb783 |
| ubuntu | https://www.cve.org/CVERecord?id=CVE-2022-48653 | https://ubuntu.com/security/CVE-2022-48653 |
| ubuntu | https://git.kernel.org/linus/23c619190318376769ad7b61504c2ea0703fb783 (6.0-rc7) | https://ubuntu.com/security/CVE-2022-48653 |
| ubuntu | https://git.kernel.org/stable/c/34447d64b8d28e4d6a73d73f07c879959d68fbfe | https://ubuntu.com/security/CVE-2022-48653 |
| ubuntu | https://git.kernel.org/stable/c/149979e87eb7a365d3d0b259bed79d84ff585a93 | https://ubuntu.com/security/CVE-2022-48653 |
| ubuntu | https://git.kernel.org/stable/c/23c619190318376769ad7b61504c2ea0703fb783 | https://ubuntu.com/security/CVE-2022-48653 |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2022-48653 | https://ubuntu.com/security/CVE-2022-48653 |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2022-48653 | https://ubuntu.com/security/CVE-2022-48653 |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2022-48653 | https://ubuntu.com/security/CVE-2022-48653 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| linux |  | https://git.kernel.org/linus/23c619190318376769ad7b61504c2ea0703fb783 | https://git.kernel.org/linus/f9f5301e7e2d4fa2445aab3ec889dac6b34ea63e | ubuntu |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:ice: Don t double unplug aux on peer initiated resetIn the IDC callback that is accessed when the aux drivers request a reset,the function to unplug the aux devices is called.  This function is alsocalled in the ice_prepare_for_reset function. This double call is causinga  scheduling while atomic  BUG.[  662.676430] ice 0000:4c:00.0 rocep76s0: cqp opcode = 0x1 maj_err_code = 0xffff min_err_code = 0x8003[  662.676609] ice 0000:4c:00.0 rocep76s0: [Modify QP Cmd Error][op_code=8] status=-29 waiting=1 completion_err=1 maj=0xffff min=0x8003[  662.815006] ice 0000:4c:00.0 rocep76s0: ICE OICR event notification: oicr = 0x10000003[  662.815014] ice 0000:4c:00.0 rocep76s0: critical PE Error, GLPE_CRITERR=0x00011424[  662.815017] ice 0000:4c:00.0 rocep76s0: Requesting a reset[  662.815475] BUG: scheduling while atomic: swapper/37/0/0x00010002[  662.815475] BUG: scheduling while atomic: swapper/37/0/0x00010002[  662.815477] Modules linked in: rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs rfkill 8021q garp mrp stp llc vfat fat rpcrdma intel_rapl_msr intel_rapl_common sunrpc i10nm_edac rdma_ucm nfit ib_srpt libnvdimm ib_isert iscsi_target_mod x86_pkg_temp_thermal intel_powerclamp coretemp target_core_mod snd_hda_intel ib_iser snd_intel_dspcfg libiscsi snd_intel_sdw_acpi scsi_transport_iscsi kvm_intel iTCO_wdt rdma_cm snd_hda_codec kvm iw_cm ipmi_ssif iTCO_vendor_support snd_hda_core irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel snd_hwdep snd_seq snd_seq_device rapl snd_pcm snd_timer isst_if_mbox_pci pcspkr isst_if_mmio irdma intel_uncore idxd acpi_ipmi joydev isst_if_common snd mei_me idxd_bus ipmi_si soundcore i2c_i801 mei ipmi_devintf i2c_smbus i2c_ismt ipmi_msghandler acpi_power_meter acpi_pad rv(OE) ib_uverbs ib_cm ib_core xfs libcrc32c ast i2c_algo_bit drm_vram_helper drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm_ttm_helpe r ttm[  662.815546]  nvme nvme_core ice drm crc32c_intel i40e t10_pi wmi pinctrl_emmitsburg dm_mirror dm_region_hash dm_log dm_mod fuse[  662.815557] Preemption disabled at:[  662.815558] [<0000000000000000>] 0x0[  662.815563] CPU: 37 PID: 0 Comm: swapper/37 Kdump: loaded Tainted: G S         OE     5.17.1 #2[  662.815566] Hardware name: Intel Corporation D50DNP/D50DNP, BIOS SE5C6301.86B.6624.D18.2111021741 11/02/2021[  662.815568] Call Trace:[  662.815572]  <IRQ>[  662.815574]  dump_stack_lvl+0x33/0x42[  662.815581]  __schedule_bug.cold.147+0x7d/0x8a[  662.815588]  __schedule+0x798/0x990[  662.815595]  schedule+0x44/0xc0[  662.815597]  schedule_preempt_disabled+0x14/0x20[  662.815600]  __mutex_lock.isra.11+0x46c/0x490[  662.815603]  ? __ibdev_printk+0x76/0xc0 [ib_core][  662.815633]  device_del+0x37/0x3d0[  662.815639]  ice_unplug_aux_dev+0x1a/0x40 [ice][  662.815674]  ice_schedule_reset+0x3c/0xd0 [ice][  662.815693]  irdma_iidc_event_handler.cold.7+0xb6/0xd3 [irdma][  662.815712]  ? bitmap_find_next_zero_area_off+0x45/0xa0[  662.815719]  ice_send_event_to_aux+0x54/0x70 [ice][  662.815741]  ice_misc_intr+0x21d/0x2d0 [ice][  662.815756]  __handle_irq_event_percpu+0x4c/0x180[  662.815762]  handle_irq_event_percpu+0xf/0x40[  662.815764]  handle_irq_event+0x34/0x60[  662.815766]  handle_edge_irq+0x9a/0x1c0[  662.815770]  __common_interrupt+0x62/0x100[  662.815774]  common_interrupt+0xb4/0xd0[  662.815779]  </IRQ>[  662.815780]  <TASK>[  662.815780]  asm_common_interrupt+0x1e/0x40[  662.815785] RIP: 0010:cpuidle_enter_state+0xd6/0x380[  662.815789] Code: 49 89 c4 0f 1f 44 00 00 31 ff e8 65 d7 95 ff 45 84 ff 74 12 9c 58 f6 c4 02 0f 85 64 02 00 00 31 ff e8 ae c5 9c ff fb 45 85 f6 <0f> 88 12 01 00 00 49 63 d6 4c 2b 24 24 48 8d 04 52 48 8d 04 82 49[  662.815791] RSP: 0018:ff2c2c4f18edbe80 EFLAGS: 00000202[  662.815793] RAX: ff280805df140000 RBX: 0000000000000002 RCX: 000000000000001f[  662.815795] RDX: 0000009a52da2d08 R---truncated---
 openEuler评分：
  3.3
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP1(4.19.90):不受影响
2.openEuler-20.03-LTS-SP4(4.19.90):不受影响
3.openEuler-22.03-LTS(5.10.0):不受影响
4.openEuler-22.03-LTS-SP1(5.10.0):不受影响
5.openEuler-22.03-LTS-SP2(5.10.0):不受影响
6.openEuler-22.03-LTS-SP3(5.10.0):不受影响
7.openEuler-22.03-LTS-SP4:不受影响
8.master(6.1.0):不受影响
9.openEuler-22.03-LTS-Next(5.10.0):不受影响
10.openEuler-24.03-LTS:不受影响
11.openEuler-24.03-LTS-Next:不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP1(4.19.90):否
2.openEuler-20.03-LTS-SP4(4.19.90):否
3.openEuler-22.03-LTS(5.10.0):否
4.openEuler-22.03-LTS-SP1(5.10.0):否
5.openEuler-22.03-LTS-SP2(5.10.0):否
6.openEuler-22.03-LTS-SP3(5.10.0):否
7.master(6.1.0):否
8.openEuler-22.03-LTS-Next(5.10.0):否
9.openEuler-24.03-LTS:否
10.openEuler-24.03-LTS-Next:否
11.openEuler-22.03-LTS-SP4:否

src-openEuler/kernel
Closed

Content Risk Flag

Comments (4)

src-openEuler/kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2022-48653

Comments (4)

Search

src-openEuler/kernel
Closed