CVE-2022-48983

一、漏洞信息
 漏洞编号：[CVE-2022-48983](https://nvd.nist.gov/vuln/detail/CVE-2022-48983)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：5.5 Medium
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:io_uring: Fix a null-ptr-deref in io_tctx_exit_cb()Syzkaller reports a NULL deref bug as follows: BUG: KASAN: null-ptr-deref in io_tctx_exit_cb+0x53/0xd3 Read of size 4 at addr 0000000000000138 by task file1/1955 CPU: 1 PID: 1955 Comm: file1 Not tainted 6.1.0-rc7-00103-gef4d3ea40565 #75 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014 Call Trace:  <TASK>  dump_stack_lvl+0xcd/0x134  ? io_tctx_exit_cb+0x53/0xd3  kasan_report+0xbb/0x1f0  ? io_tctx_exit_cb+0x53/0xd3  kasan_check_range+0x140/0x190  io_tctx_exit_cb+0x53/0xd3  task_work_run+0x164/0x250  ? task_work_cancel+0x30/0x30  get_signal+0x1c3/0x2440  ? lock_downgrade+0x6e0/0x6e0  ? lock_downgrade+0x6e0/0x6e0  ? exit_signals+0x8b0/0x8b0  ? do_raw_read_unlock+0x3b/0x70  ? do_raw_spin_unlock+0x50/0x230  arch_do_signal_or_restart+0x82/0x2470  ? kmem_cache_free+0x260/0x4b0  ? putname+0xfe/0x140  ? get_sigframe_size+0x10/0x10  ? do_execveat_common.isra.0+0x226/0x710  ? lockdep_hardirqs_on+0x79/0x100  ? putname+0xfe/0x140  ? do_execveat_common.isra.0+0x238/0x710  exit_to_user_mode_prepare+0x15f/0x250  syscall_exit_to_user_mode+0x19/0x50  do_syscall_64+0x42/0xb0  entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0023:0x0 Code: Unable to access opcode bytes at 0xffffffffffffffd6. RSP: 002b:00000000fffb7790 EFLAGS: 00000200 ORIG_RAX: 000000000000000b RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000  </TASK> Kernel panic - not syncing: panic_on_warn set ...This happens because the adding of task_work from io_ring_exit_work()isn t synchronized with canceling all work items from eg exec. Theexecution of the two are ordered in that they are both run by the taskitself, but if io_tctx_exit_cb() is queued while we re canceling allwork items off exec AND gets executed when the task exits to userspacerather than in the main loop in io_uring_cancel_generic(), then we canfind current->io_uring == NULL and hit the above crash.It s safe to add this NULL check here, because the execution of the twopaths are done by the task itself.[axboe: add code comment and also put an explanation in the commit msg]
 漏洞公开时间：2024-10-22 04:15:10
 漏洞创建时间：2024-10-22 05:01:09
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2022-48983
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/998b30c3948e4d0b1097e639918c5cff332acac5 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/d91edca1943453aaaba4f380f6f364346222e5cf |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/f895511de9d27fff71dad2c234ad53b4afd2b06c |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-48983 | https://bugzilla.suse.com/show_bug.cgi?id=1231959 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2022-48983 | https://bugzilla.suse.com/show_bug.cgi?id=1231959 |
| suse_bugzilla | https://git.kernel.org/stable/c/998b30c3948e4d0b1097e639918c5cff332acac5 | https://bugzilla.suse.com/show_bug.cgi?id=1231959 |
| suse_bugzilla | https://git.kernel.org/stable/c/d91edca1943453aaaba4f380f6f364346222e5cf | https://bugzilla.suse.com/show_bug.cgi?id=1231959 |
| suse_bugzilla | https://git.kernel.org/stable/c/f895511de9d27fff71dad2c234ad53b4afd2b06c | https://bugzilla.suse.com/show_bug.cgi?id=1231959 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2022/CVE-2022-48983.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1231959 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2320786 | https://bugzilla.suse.com/show_bug.cgi?id=1231959 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2024102147-CVE-2022-48983-7e0c@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2320786 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://git.kernel.org/stable/c/998b30c3948e4d0b1097e639918c5cff332acac5 |  | nvd |
|  |  | https://git.kernel.org/stable/c/d91edca1943453aaaba4f380f6f364346222e5cf |  | nvd |
|  |  | https://git.kernel.org/stable/c/f895511de9d27fff71dad2c234ad53b4afd2b06c |  | nvd |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:io_uring: Fix a null-ptr-deref in io_tctx_exit_cb()Syzkaller reports a NULL deref bug as follows: BUG: KASAN: null-ptr-deref in io_tctx_exit_cb+0x53/0xd3 Read of size 4 at addr 0000000000000138 by task file1/1955 CPU: 1 PID: 1955 Comm: file1 Not tainted 6.1.0-rc7-00103-gef4d3ea40565 #75 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014 Call Trace:  <TASK>  dump_stack_lvl+0xcd/0x134  ? io_tctx_exit_cb+0x53/0xd3  kasan_report+0xbb/0x1f0  ? io_tctx_exit_cb+0x53/0xd3  kasan_check_range+0x140/0x190  io_tctx_exit_cb+0x53/0xd3  task_work_run+0x164/0x250  ? task_work_cancel+0x30/0x30  get_signal+0x1c3/0x2440  ? lock_downgrade+0x6e0/0x6e0  ? lock_downgrade+0x6e0/0x6e0  ? exit_signals+0x8b0/0x8b0  ? do_raw_read_unlock+0x3b/0x70  ? do_raw_spin_unlock+0x50/0x230  arch_do_signal_or_restart+0x82/0x2470  ? kmem_cache_free+0x260/0x4b0  ? putname+0xfe/0x140  ? get_sigframe_size+0x10/0x10  ? do_execveat_common.isra.0+0x226/0x710  ? lockdep_hardirqs_on+0x79/0x100  ? putname+0xfe/0x140  ? do_execveat_common.isra.0+0x238/0x710  exit_to_user_mode_prepare+0x15f/0x250  syscall_exit_to_user_mode+0x19/0x50  do_syscall_64+0x42/0xb0  entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0023:0x0 Code: Unable to access opcode bytes at 0xffffffffffffffd6. RSP: 002b:00000000fffb7790 EFLAGS: 00000200 ORIG_RAX: 000000000000000b RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000  </TASK> Kernel panic - not syncing: panic_on_warn set ...This happens because the adding of task_work from io_ring_exit_work()isn t synchronized with canceling all work items from eg exec. Theexecution of the two are ordered in that they are both run by the taskitself, but if io_tctx_exit_cb() is queued while we re canceling allwork items off exec AND gets executed when the task exits to userspacerather than in the main loop in io_uring_cancel_generic(), then we canfind current->io_uring == NULL and hit the above crash.It s safe to add this NULL check here, because the execution of the twopaths are done by the task itself.[axboe: add code comment and also put an explanation in the commit msg]
 openEuler评分：
  5.5
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(4.19.90):不受影响
2.openEuler-22.03-LTS-SP1(5.10.0):不受影响
3.openEuler-22.03-LTS-SP3(5.10.0):不受影响
4.openEuler-22.03-LTS-SP4(5.10.0):不受影响
5.master(6.6.0):不受影响
6.openEuler-24.03-LTS(6.6.0):不受影响
7.openEuler-24.03-LTS-Next(6.6.0):不受影响
8.openEuler-24.03-LTS-SP1:不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1(5.10.0):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.master(6.6.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-22.03-LTS-SP4(5.10.0):否
8.openEuler-24.03-LTS-SP1:否

原因说明：
  1.openEuler-20.03-LTS-SP4(4.19.90):不受影响-漏洞代码不存在
2.openEuler-22.03-LTS-SP1(5.10.0):不受影响-漏洞代码不存在
3.openEuler-22.03-LTS-SP3(5.10.0):不受影响-漏洞代码不存在
4.openEuler-22.03-LTS-SP4(5.10.0):不受影响-漏洞代码不存在
5.master(6.6.0):不受影响-漏洞代码不存在
6.openEuler-24.03-LTS(6.6.0):不受影响-漏洞代码不存在
7.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不存在
8.openEuler-24.03-LTS-SP1:不受影响-漏洞代码不存在

src-openEuler / kernel
Closed

Content Risk Flag

Comments (14)

src-openEuler / kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2022-48983

Comments (14)

Search

src-openEuler / kernel
Closed