CVE-2022-48796

一、漏洞信息
 漏洞编号：[CVE-2022-48796](https://nvd.nist.gov/vuln/detail/CVE-2022-48796)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：7.8 High
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:iommu: Fix potential use-after-free during probeKasan has reported the following use after free on dev->iommu.when a device probe fails and it is in process of freeing dev->iommuin dev_iommu_free function, a deferred_probe_work_func runs in paralleland tries to access dev->iommu->fwspec in of_iommu_configure path thuscausing use after free.BUG: KASAN: use-after-free in of_iommu_configure+0xb4/0x4a4Read of size 8 at addr ffffff87a2f1acb8 by task kworker/u16:2/153Workqueue: events_unbound deferred_probe_work_funcCall trace: dump_backtrace+0x0/0x33c show_stack+0x18/0x24 dump_stack_lvl+0x16c/0x1e0 print_address_description+0x84/0x39c __kasan_report+0x184/0x308 kasan_report+0x50/0x78 __asan_load8+0xc0/0xc4 of_iommu_configure+0xb4/0x4a4 of_dma_configure_id+0x2fc/0x4d4 platform_dma_configure+0x40/0x5c really_probe+0x1b4/0xb74 driver_probe_device+0x11c/0x228 __device_attach_driver+0x14c/0x304 bus_for_each_drv+0x124/0x1b0 __device_attach+0x25c/0x334 device_initial_probe+0x24/0x34 bus_probe_device+0x78/0x134 deferred_probe_work_func+0x130/0x1a8 process_one_work+0x4c8/0x970 worker_thread+0x5c8/0xaec kthread+0x1f8/0x220 ret_from_fork+0x10/0x18Allocated by task 1: ____kasan_kmalloc+0xd4/0x114 __kasan_kmalloc+0x10/0x1c kmem_cache_alloc_trace+0xe4/0x3d4 __iommu_probe_device+0x90/0x394 probe_iommu_group+0x70/0x9c bus_for_each_dev+0x11c/0x19c bus_iommu_probe+0xb8/0x7d4 bus_set_iommu+0xcc/0x13c arm_smmu_bus_init+0x44/0x130 [arm_smmu] arm_smmu_device_probe+0xb88/0xc54 [arm_smmu] platform_drv_probe+0xe4/0x13c really_probe+0x2c8/0xb74 driver_probe_device+0x11c/0x228 device_driver_attach+0xf0/0x16c __driver_attach+0x80/0x320 bus_for_each_dev+0x11c/0x19c driver_attach+0x38/0x48 bus_add_driver+0x1dc/0x3a4 driver_register+0x18c/0x244 __platform_driver_register+0x88/0x9c init_module+0x64/0xff4 [arm_smmu] do_one_initcall+0x17c/0x2f0 do_init_module+0xe8/0x378 load_module+0x3f80/0x4a40 __se_sys_finit_module+0x1a0/0x1e4 __arm64_sys_finit_module+0x44/0x58 el0_svc_common+0x100/0x264 do_el0_svc+0x38/0xa4 el0_svc+0x20/0x30 el0_sync_handler+0x68/0xac el0_sync+0x160/0x180Freed by task 1: kasan_set_track+0x4c/0x84 kasan_set_free_info+0x28/0x4c ____kasan_slab_free+0x120/0x15c __kasan_slab_free+0x18/0x28 slab_free_freelist_hook+0x204/0x2fc kfree+0xfc/0x3a4 __iommu_probe_device+0x284/0x394 probe_iommu_group+0x70/0x9c bus_for_each_dev+0x11c/0x19c bus_iommu_probe+0xb8/0x7d4 bus_set_iommu+0xcc/0x13c arm_smmu_bus_init+0x44/0x130 [arm_smmu] arm_smmu_device_probe+0xb88/0xc54 [arm_smmu] platform_drv_probe+0xe4/0x13c really_probe+0x2c8/0xb74 driver_probe_device+0x11c/0x228 device_driver_attach+0xf0/0x16c __driver_attach+0x80/0x320 bus_for_each_dev+0x11c/0x19c driver_attach+0x38/0x48 bus_add_driver+0x1dc/0x3a4 driver_register+0x18c/0x244 __platform_driver_register+0x88/0x9c init_module+0x64/0xff4 [arm_smmu] do_one_initcall+0x17c/0x2f0 do_init_module+0xe8/0x378 load_module+0x3f80/0x4a40 __se_sys_finit_module+0x1a0/0x1e4 __arm64_sys_finit_module+0x44/0x58 el0_svc_common+0x100/0x264 do_el0_svc+0x38/0xa4 el0_svc+0x20/0x30 el0_sync_handler+0x68/0xac el0_sync+0x160/0x180Fix this by setting dev->iommu to NULL first andthen freeing dev_iommu structure in dev_iommu_freefunction.
 漏洞公开时间：2024-07-16 20:15:04
 漏洞创建时间：2024-07-16 22:51:30
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2022-48796
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/65ab30f6a6952fa9ee13009862736cf8d110e6e5 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/b54240ad494300ff0994c4539a531727874381f4 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/cb86e511e78e796de6947b8f3acca1b7c76fb2ff |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/f74fc4b5bd533ea3d30ce47cccb8ef8d21fda85a |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-48796 | https://bugzilla.suse.com/show_bug.cgi?id=1228028 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2022/CVE-2022-48796.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1228028 |
| suse_bugzilla | https://git.kernel.org/stable/c/cb86e511e78e796de6947b8f3acca1b7c76fb2ff | https://bugzilla.suse.com/show_bug.cgi?id=1228028 |
| suse_bugzilla | https://git.kernel.org/stable/c/65ab30f6a6952fa9ee13009862736cf8d110e6e5 | https://bugzilla.suse.com/show_bug.cgi?id=1228028 |
| suse_bugzilla | https://git.kernel.org/stable/c/f74fc4b5bd533ea3d30ce47cccb8ef8d21fda85a | https://bugzilla.suse.com/show_bug.cgi?id=1228028 |
| suse_bugzilla | https://git.kernel.org/stable/c/b54240ad494300ff0994c4539a531727874381f4 | https://bugzilla.suse.com/show_bug.cgi?id=1228028 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2022-48796 | https://bugzilla.suse.com/show_bug.cgi?id=1228028 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2298132 | https://bugzilla.suse.com/show_bug.cgi?id=1228028 |
| ubuntu | https://www.cve.org/CVERecord?id=CVE-2022-48796 | https://ubuntu.com/security/CVE-2022-48796 |
| ubuntu | https://git.kernel.org/linus/b54240ad494300ff0994c4539a531727874381f4 (5.17-rc3) | https://ubuntu.com/security/CVE-2022-48796 |
| ubuntu | https://git.kernel.org/stable/c/cb86e511e78e796de6947b8f3acca1b7c76fb2ff | https://ubuntu.com/security/CVE-2022-48796 |
| ubuntu | https://git.kernel.org/stable/c/65ab30f6a6952fa9ee13009862736cf8d110e6e5 | https://ubuntu.com/security/CVE-2022-48796 |
| ubuntu | https://git.kernel.org/stable/c/f74fc4b5bd533ea3d30ce47cccb8ef8d21fda85a | https://ubuntu.com/security/CVE-2022-48796 |
| ubuntu | https://git.kernel.org/stable/c/b54240ad494300ff0994c4539a531727874381f4 | https://ubuntu.com/security/CVE-2022-48796 |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2022-48796 | https://ubuntu.com/security/CVE-2022-48796 |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2022-48796 | https://ubuntu.com/security/CVE-2022-48796 |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2022-48796 | https://ubuntu.com/security/CVE-2022-48796 |
| amazon_linux_explore | https://access.redhat.com/security/cve/CVE-2022-48796 | https://explore.alas.aws.amazon.com/CVE-2022-48796.html |
| amazon_linux_explore | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-48796 | https://explore.alas.aws.amazon.com/CVE-2022-48796.html |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://git.kernel.org/stable/c/65ab30f6a6952fa9ee13009862736cf8d110e6e5 |  | nvd |
|  |  | https://git.kernel.org/stable/c/b54240ad494300ff0994c4539a531727874381f4 |  | nvd |
|  |  | https://git.kernel.org/stable/c/cb86e511e78e796de6947b8f3acca1b7c76fb2ff |  | nvd |
|  |  | https://git.kernel.org/stable/c/f74fc4b5bd533ea3d30ce47cccb8ef8d21fda85a |  | nvd |
| linux |  | https://git.kernel.org/linus/b54240ad494300ff0994c4539a531727874381f4 | https://git.kernel.org/linus/5375e874c7634f0e1795ec4b37260b724d481e86 | ubuntu |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
    In the Linux kernel, the following vulnerability has been resolved:iommu: Fix potential use-after-free during probeKasan has reported the following use after free on dev->iommu.when a device probe fails and it is in process of freeing dev->iommuin dev_iommu_free function, a deferred_probe_work_func runs in paralleland tries to access dev->iommu->fwspec in of_iommu_configure path thuscausing use after free.BUG: KASAN: use-after-free in of_iommu_configure+0xb4/0x4a4Read of size 8 at addr ffffff87a2f1acb8 by task kworker/u16:2/153Workqueue: events_unbound deferred_probe_work_funcCall trace: dump_backtrace+0x0/0x33c show_stack+0x18/0x24 dump_stack_lvl+0x16c/0x1e0 print_address_description+0x84/0x39c __kasan_report+0x184/0x308 kasan_report+0x50/0x78 __asan_load8+0xc0/0xc4 of_iommu_configure+0xb4/0x4a4 of_dma_configure_id+0x2fc/0x4d4 platform_dma_configure+0x40/0x5c really_probe+0x1b4/0xb74 driver_probe_device+0x11c/0x228 __device_attach_driver+0x14c/0x304 bus_for_each_drv+0x124/0x1b0 __device_attach+0x25c/0x334 device_initial_probe+0x24/0x34 bus_probe_device+0x78/0x134 deferred_probe_work_func+0x130/0x1a8 process_one_work+0x4c8/0x970 worker_thread+0x5c8/0xaec kthread+0x1f8/0x220 ret_from_fork+0x10/0x18Allocated by task 1: ____kasan_kmalloc+0xd4/0x114 __kasan_kmalloc+0x10/0x1c kmem_cache_alloc_trace+0xe4/0x3d4 __iommu_probe_device+0x90/0x394 probe_iommu_group+0x70/0x9c bus_for_each_dev+0x11c/0x19c bus_iommu_probe+0xb8/0x7d4 bus_set_iommu+0xcc/0x13c arm_smmu_bus_init+0x44/0x130 [arm_smmu] arm_smmu_device_probe+0xb88/0xc54 [arm_smmu] platform_drv_probe+0xe4/0x13c really_probe+0x2c8/0xb74 driver_probe_device+0x11c/0x228 device_driver_attach+0xf0/0x16c __driver_attach+0x80/0x320 bus_for_each_dev+0x11c/0x19c driver_attach+0x38/0x48 bus_add_driver+0x1dc/0x3a4 driver_register+0x18c/0x244 __platform_driver_register+0x88/0x9c init_module+0x64/0xff4 [arm_smmu] do_one_initcall+0x17c/0x2f0 do_init_module+0xe8/0x378 load_module+0x3f80/0x4a40 __se_sys_finit_module+0x1a0/0x1e4 __arm64_sys_finit_module+0x44/0x58 el0_svc_common+0x100/0x264 do_el0_svc+0x38/0xa4 el0_svc+0x20/0x30 el0_sync_handler+0x68/0xac el0_sync+0x160/0x180Freed by task 1: kasan_set_track+0x4c/0x84 kasan_set_free_info+0x28/0x4c ____kasan_slab_free+0x120/0x15c __kasan_slab_free+0x18/0x28 slab_free_freelist_hook+0x204/0x2fc kfree+0xfc/0x3a4 __iommu_probe_device+0x284/0x394 probe_iommu_group+0x70/0x9c bus_for_each_dev+0x11c/0x19c bus_iommu_probe+0xb8/0x7d4 bus_set_iommu+0xcc/0x13c arm_smmu_bus_init+0x44/0x130 [arm_smmu] arm_smmu_device_probe+0xb88/0xc54 [arm_smmu] platform_drv_probe+0xe4/0x13c really_probe+0x2c8/0xb74 driver_probe_device+0x11c/0x228 device_driver_attach+0xf0/0x16c __driver_attach+0x80/0x320 bus_for_each_dev+0x11c/0x19c driver_attach+0x38/0x48 bus_add_driver+0x1dc/0x3a4 driver_register+0x18c/0x244 __platform_driver_register+0x88/0x9c init_module+0x64/0xff4 [arm_smmu] do_one_initcall+0x17c/0x2f0 do_init_module+0xe8/0x378 load_module+0x3f80/0x4a40 __se_sys_finit_module+0x1a0/0x1e4 __arm64_sys_finit_module+0x44/0x58 el0_svc_common+0x100/0x264 do_el0_svc+0x38/0xa4 el0_svc+0x20/0x30 el0_sync_handler+0x68/0xac el0_sync+0x160/0x180Fix this by setting dev->iommu to NULL first andthen freeing dev_iommu structure in dev_iommu_freefunction. 
 openEuler评分：
  7.8
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(4.19.90):不受影响
2.openEuler-22.03-LTS-SP1(5.10.0):不受影响
3.openEuler-22.03-LTS-SP3(5.10.0):不受影响
4.openEuler-22.03-LTS-SP4(5.10.0):不受影响
5.master(6.1.0):不受影响
6.openEuler-24.03-LTS(6.6.0):不受影响
7.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1(5.10.0):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.master(6.1.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-22.03-LTS-SP4(5.10.0):否

src-openEuler / kernel
关闭

内容风险标识

评论 (7)

src-openEuler / kernel关闭 .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2022-48796

评论 (7)

搜索帮助

src-openEuler / kernel
关闭