CVE-2022-48937

一、漏洞信息
 漏洞编号：[CVE-2022-48937](https://nvd.nist.gov/vuln/detail/CVE-2022-48937)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：3.3 Low
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:io_uring: add a schedule point in io_add_buffers()Looping ~65535 times doing kmalloc() calls can trigger soft lockups,especially with DEBUG features (like KASAN).[  253.536212] watchdog: BUG: soft lockup - CPU#64 stuck for 26s! [b219417889:12575][  253.544433] Modules linked in: vfat fat i2c_mux_pca954x i2c_mux spidev cdc_acm xhci_pci xhci_hcd sha3_generic gq(O)[  253.544451] CPU: 64 PID: 12575 Comm: b219417889 Tainted: G S         O      5.17.0-smp-DEV #801[  253.544457] RIP: 0010:kernel_text_address (./include/asm-generic/sections.h:192 ./include/linux/kallsyms.h:29 kernel/extable.c:67 kernel/extable.c:98)[  253.544464] Code: 0f 93 c0 48 c7 c1 e0 63 d7 a4 48 39 cb 0f 92 c1 20 c1 0f b6 c1 5b 5d c3 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 53 48 89 fb <48> c7 c0 00 00 80 a0 41 be 01 00 00 00 48 39 c7 72 0c 48 c7 c0 40[  253.544468] RSP: 0018:ffff8882d8baf4c0 EFLAGS: 00000246[  253.544471] RAX: 1ffff1105b175e00 RBX: ffffffffa13ef09a RCX: 00000000a13ef001[  253.544474] RDX: ffffffffa13ef09a RSI: ffff8882d8baf558 RDI: ffffffffa13ef09a[  253.544476] RBP: ffff8882d8baf4d8 R08: ffff8882d8baf5e0 R09: 0000000000000004[  253.544479] R10: ffff8882d8baf5e8 R11: ffffffffa0d59a50 R12: ffff8882eab20380[  253.544481] R13: ffffffffa0d59a50 R14: dffffc0000000000 R15: 1ffff1105b175eb0[  253.544483] FS:  00000000016d3380(0000) GS:ffff88af48c00000(0000) knlGS:0000000000000000[  253.544486] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033[  253.544488] CR2: 00000000004af0f0 CR3: 00000002eabfa004 CR4: 00000000003706e0[  253.544491] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000[  253.544492] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400[  253.544494] Call Trace:[  253.544496]  <TASK>[  253.544498] ? io_queue_sqe (fs/io_uring.c:7143)[  253.544505] __kernel_text_address (kernel/extable.c:78)[  253.544508] unwind_get_return_address (arch/x86/kernel/unwind_frame.c:19)[  253.544514] arch_stack_walk (arch/x86/kernel/stacktrace.c:27)[  253.544517] ? io_queue_sqe (fs/io_uring.c:7143)[  253.544521] stack_trace_save (kernel/stacktrace.c:123)[  253.544527] ____kasan_kmalloc (mm/kasan/common.c:39 mm/kasan/common.c:45 mm/kasan/common.c:436 mm/kasan/common.c:515)[  253.544531] ? ____kasan_kmalloc (mm/kasan/common.c:39 mm/kasan/common.c:45 mm/kasan/common.c:436 mm/kasan/common.c:515)[  253.544533] ? __kasan_kmalloc (mm/kasan/common.c:524)[  253.544535] ? kmem_cache_alloc_trace (./include/linux/kasan.h:270 mm/slab.c:3567)[  253.544541] ? io_issue_sqe (fs/io_uring.c:4556 fs/io_uring.c:4589 fs/io_uring.c:6828)[  253.544544] ? __io_queue_sqe (fs/io_uring.c:?)[  253.544551] __kasan_kmalloc (mm/kasan/common.c:524)[  253.544553] kmem_cache_alloc_trace (./include/linux/kasan.h:270 mm/slab.c:3567)[  253.544556] ? io_issue_sqe (fs/io_uring.c:4556 fs/io_uring.c:4589 fs/io_uring.c:6828)[  253.544560] io_issue_sqe (fs/io_uring.c:4556 fs/io_uring.c:4589 fs/io_uring.c:6828)[  253.544564] ? __kasan_slab_alloc (mm/kasan/common.c:45 mm/kasan/common.c:436 mm/kasan/common.c:469)[  253.544567] ? __kasan_slab_alloc (mm/kasan/common.c:39 mm/kasan/common.c:45 mm/kasan/common.c:436 mm/kasan/common.c:469)[  253.544569] ? kmem_cache_alloc_bulk (mm/slab.h:732 mm/slab.c:3546)[  253.544573] ? __io_alloc_req_refill (fs/io_uring.c:2078)[  253.544578] ? io_submit_sqes (fs/io_uring.c:7441)[  253.544581] ? __se_sys_io_uring_enter (fs/io_uring.c:10154 fs/io_uring.c:10096)[  253.544584] ? __x64_sys_io_uring_enter (fs/io_uring.c:10096)[  253.544587] ? do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80)[  253.544590] ? entry_SYSCALL_64_after_hwframe (??:?)[  253.544596] __io_queue_sqe (fs/io_uring.c:?)[  253.544600] io_queue_sqe (fs/io_uring.c:7143)[  253.544603] io_submit_sqe (fs/io_uring.c:?)[  253.544608] io_submit_sqes (fs/io_uring.c:?)[  253.544612] __se_sys_io_uring_enter (fs/io_uring.c:10154 fs/io_uri---truncated---
 漏洞公开时间：2024-08-22 12:15:17
 漏洞创建时间：2024-08-22 21:20:44
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2022-48937
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/4a93c6594613c3429b6f30136fff115c7f803af4 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/8f3cc3c5bc43d03b5748ac4fb8d180084952c36a |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/c718ea4e7382e18957ed0e88a5f855e2122d9c00 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/f240762f88b4b1b58561939ffd44837759756477 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-48937 | https://bugzilla.suse.com/show_bug.cgi?id=1229617 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2022-48937 | https://bugzilla.suse.com/show_bug.cgi?id=1229617 |
| suse_bugzilla | https://git.kernel.org/stable/c/4a93c6594613c3429b6f30136fff115c7f803af4 | https://bugzilla.suse.com/show_bug.cgi?id=1229617 |
| suse_bugzilla | https://git.kernel.org/stable/c/8f3cc3c5bc43d03b5748ac4fb8d180084952c36a | https://bugzilla.suse.com/show_bug.cgi?id=1229617 |
| suse_bugzilla | https://git.kernel.org/stable/c/c718ea4e7382e18957ed0e88a5f855e2122d9c00 | https://bugzilla.suse.com/show_bug.cgi?id=1229617 |
| suse_bugzilla | https://git.kernel.org/stable/c/f240762f88b4b1b58561939ffd44837759756477 | https://bugzilla.suse.com/show_bug.cgi?id=1229617 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2022/CVE-2022-48937.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1229617 |
| ubuntu | https://www.cve.org/CVERecord?id=CVE-2022-48937 | https://ubuntu.com/security/CVE-2022-48937 |
| ubuntu | https://git.kernel.org/linus/f240762f88b4b1b58561939ffd44837759756477 (5.17-rc6) | https://ubuntu.com/security/CVE-2022-48937 |
| ubuntu | https://git.kernel.org/stable/c/4a93c6594613c3429b6f30136fff115c7f803af4 | https://ubuntu.com/security/CVE-2022-48937 |
| ubuntu | https://git.kernel.org/stable/c/c718ea4e7382e18957ed0e88a5f855e2122d9c00 | https://ubuntu.com/security/CVE-2022-48937 |
| ubuntu | https://git.kernel.org/stable/c/8f3cc3c5bc43d03b5748ac4fb8d180084952c36a | https://ubuntu.com/security/CVE-2022-48937 |
| ubuntu | https://git.kernel.org/stable/c/f240762f88b4b1b58561939ffd44837759756477 | https://ubuntu.com/security/CVE-2022-48937 |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2022-48937 | https://ubuntu.com/security/CVE-2022-48937 |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2022-48937 | https://ubuntu.com/security/CVE-2022-48937 |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2022-48937 | https://ubuntu.com/security/CVE-2022-48937 |
| cve_search |  | https://git.kernel.org/stable/c/4a93c6594613c3429b6f30136fff115c7f803af4 |
| cve_search |  | https://git.kernel.org/stable/c/c718ea4e7382e18957ed0e88a5f855e2122d9c00 |
| cve_search |  | https://git.kernel.org/stable/c/8f3cc3c5bc43d03b5748ac4fb8d180084952c36a |
| cve_search |  | https://git.kernel.org/stable/c/f240762f88b4b1b58561939ffd44837759756477 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://git.kernel.org/stable/c/4a93c6594613c3429b6f30136fff115c7f803af4 |  | nvd |
|  |  | https://git.kernel.org/stable/c/8f3cc3c5bc43d03b5748ac4fb8d180084952c36a |  | nvd |
|  |  | https://git.kernel.org/stable/c/c718ea4e7382e18957ed0e88a5f855e2122d9c00 |  | nvd |
|  |  | https://git.kernel.org/stable/c/f240762f88b4b1b58561939ffd44837759756477 |  | nvd |
| linux |  | https://git.kernel.org/linus/f240762f88b4b1b58561939ffd44837759756477 | https://git.kernel.org/linus/ddf0322db79c5984dc1a1db890f946dd19b7d6d9 | ubuntu |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
      In the Linux kernel, the following vulnerability has been resolved:io_uring: add a schedule point in io_add_buffers()Looping ~65535 times doing kmalloc() calls can trigger soft lockups,especially with DEBUG features (like KASAN).[  253.536212] watchdog: BUG: soft lockup - CPU#64 stuck for 26s! [b219417889:12575][  253.544433] Modules linked in: vfat fat i2c_mux_pca954x i2c_mux spidev cdc_acm xhci_pci xhci_hcd sha3_generic gq(O)[  253.544451] CPU: 64 PID: 12575 Comm: b219417889 Tainted: G S         O      5.17.0-smp-DEV #801[  253.544457] RIP: 0010:kernel_text_address (./include/asm-generic/sections.h:192 ./include/linux/kallsyms.h:29 kernel/extable.c:67 kernel/extable.c:98)[  253.544464] Code: 0f 93 c0 48 c7 c1 e0 63 d7 a4 48 39 cb 0f 92 c1 20 c1 0f b6 c1 5b 5d c3 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 53 48 89 fb <48> c7 c0 00 00 80 a0 41 be 01 00 00 00 48 39 c7 72 0c 48 c7 c0 40[  253.544468] RSP: 0018:ffff8882d8baf4c0 EFLAGS: 00000246[  253.544471] RAX: 1ffff1105b175e00 RBX: ffffffffa13ef09a RCX: 00000000a13ef001[  253.544474] RDX: ffffffffa13ef09a RSI: ffff8882d8baf558 RDI: ffffffffa13ef09a[  253.544476] RBP: ffff8882d8baf4d8 R08: ffff8882d8baf5e0 R09: 0000000000000004[  253.544479] R10: ffff8882d8baf5e8 R11: ffffffffa0d59a50 R12: ffff8882eab20380[  253.544481] R13: ffffffffa0d59a50 R14: dffffc0000000000 R15: 1ffff1105b175eb0[  253.544483] FS:  00000000016d3380(0000) GS:ffff88af48c00000(0000) knlGS:0000000000000000[  253.544486] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033[  253.544488] CR2: 00000000004af0f0 CR3: 00000002eabfa004 CR4: 00000000003706e0[  253.544491] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000[  253.544492] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400[  253.544494] Call Trace:[  253.544496]  <TASK>[  253.544498] ? io_queue_sqe (fs/io_uring.c:7143)[  253.544505] __kernel_text_address (kernel/extable.c:78)[  253.544508] unwind_get_return_address (arch/x86/kernel/unwind_frame.c:19)[  253.544514] arch_stack_walk (arch/x86/kernel/stacktrace.c:27)[  253.544517] ? io_queue_sqe (fs/io_uring.c:7143)[  253.544521] stack_trace_save (kernel/stacktrace.c:123)[  253.544527] ____kasan_kmalloc (mm/kasan/common.c:39 mm/kasan/common.c:45 mm/kasan/common.c:436 mm/kasan/common.c:515)[  253.544531] ? ____kasan_kmalloc (mm/kasan/common.c:39 mm/kasan/common.c:45 mm/kasan/common.c:436 mm/kasan/common.c:515)[  253.544533] ? __kasan_kmalloc (mm/kasan/common.c:524)[  253.544535] ? kmem_cache_alloc_trace (./include/linux/kasan.h:270 mm/slab.c:3567)[  253.544541] ? io_issue_sqe (fs/io_uring.c:4556 fs/io_uring.c:4589 fs/io_uring.c:6828)[  253.544544] ? __io_queue_sqe (fs/io_uring.c:?)[  253.544551] __kasan_kmalloc (mm/kasan/common.c:524)[  253.544553] kmem_cache_alloc_trace (./include/linux/kasan.h:270 mm/slab.c:3567)[  253.544556] ? io_issue_sqe (fs/io_uring.c:4556 fs/io_uring.c:4589 fs/io_uring.c:6828)[  253.544560] io_issue_sqe (fs/io_uring.c:4556 fs/io_uring.c:4589 fs/io_uring.c:6828)[  253.544564] ? __kasan_slab_alloc (mm/kasan/common.c:45 mm/kasan/common.c:436 mm/kasan/common.c:469)[  253.544567] ? __kasan_slab_alloc (mm/kasan/common.c:39 mm/kasan/common.c:45 mm/kasan/common.c:436 mm/kasan/common.c:469)[  253.544569] ? kmem_cache_alloc_bulk (mm/slab.h:732 mm/slab.c:3546)[  253.544573] ? __io_alloc_req_refill (fs/io_uring.c:2078)[  253.544578] ? io_submit_sqes (fs/io_uring.c:7441)[  253.544581] ? __se_sys_io_uring_enter (fs/io_uring.c:10154 fs/io_uring.c:10096)[  253.544584] ? __x64_sys_io_uring_enter (fs/io_uring.c:10096)[  253.544587] ? do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80)[  253.544590] ? entry_SYSCALL_64_after_hwframe (??:?)[  253.544596] __io_queue_sqe (fs/io_uring.c:?)[  253.544600] io_queue_sqe (fs/io_uring.c:7143)[  253.544603] io_submit_sqe (fs/io_uring.c:?)[  253.544608] io_submit_sqes (fs/io_uring.c:?)[  253.544612] __se_sys_io_uring_enter (fs/io_uring.c:10154 fs/io_uri---truncated---  
 openEuler评分：
  3.3
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(4.19.90):受影响
2.openEuler-22.03-LTS-SP1(5.10.0):不受影响
3.openEuler-22.03-LTS-SP3(5.10.0):不受影响
4.openEuler-22.03-LTS-SP4(5.10.0):不受影响
5.master(6.6.0):不受影响
6.openEuler-24.03-LTS(6.6.0):不受影响
7.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1(5.10.0):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.master(6.6.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-22.03-LTS-SP4(5.10.0):否

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2024-2109

src-openEuler/kernel
Closed

Content Risk Flag

Comments (16)

src-openEuler/kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2022-48937

Comments (16)

Search

src-openEuler/kernel
Closed