CVE-2022-49003

一、漏洞信息
 漏洞编号：[CVE-2022-49003](https://nvd.nist.gov/vuln/detail/CVE-2022-49003)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：4.7 Medium
  Vector：CVSS：3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:nvme: fix SRCU protection of nvme_ns_head listWalking the nvme_ns_head siblings list is protected by the head s srcuin nvme_ns_head_submit_bio() but not nvme_mpath_revalidate_paths().Removing namespaces from the list also fails to synchronize the srcu.Concurrent scan work can therefore cause use-after-frees.Hold the head s srcu lock in nvme_mpath_revalidate_paths() andsynchronize with the srcu, not the global RCU, in nvme_ns_remove().Observed the following panic when making NVMe/RDMA connectionswith native multipath on the Rocky Linux 8.6 kernel(it seems the upstream kernel has the same race condition).Disassembly shows the faulting instruction is cmp 0x50(%rdx),%rcx;computing capacity != get_capacity(ns->disk).Address 0x50 is dereferenced because ns->disk is NULL.The NULL disk appears to be the result of concurrent scan workfreeing the namespace (note the log line in the middle of the panic).[37314.206036] BUG: unable to handle kernel NULL pointer dereference at 0000000000000050[37314.206036] nvme0n3: detected capacity change from 0 to 11811160064[37314.299753] PGD 0 P4D 0[37314.299756] Oops: 0000 [#1] SMP PTI[37314.299759] CPU: 29 PID: 322046 Comm: kworker/u98:3 Kdump: loaded Tainted: G        W      X --------- -  - 4.18.0-372.32.1.el8test86.x86_64 #1[37314.299762] Hardware name: Dell Inc. PowerEdge R720/0JP31P, BIOS 2.7.0 05/23/2018[37314.299763] Workqueue: nvme-wq nvme_scan_work [nvme_core][37314.299783] RIP: 0010:nvme_mpath_revalidate_paths+0x26/0xb0 [nvme_core][37314.299790] Code: 1f 44 00 00 66 66 66 66 90 55 53 48 8b 5f 50 48 8b 83 c8 c9 00 00 48 8b 13 48 8b 48 50 48 39 d3 74 20 48 8d 42 d0 48 8b 50 20 <48> 3b 4a 50 74 05 f0 80 60 70 ef 48 8b 50 30 48 8d 42 d0 48 39 d3[37315.058803] RSP: 0018:ffffabe28f913d10 EFLAGS: 00010202[37315.121316] RAX: ffff927a077da800 RBX: ffff92991dd70000 RCX: 0000000001600000[37315.206704] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff92991b719800[37315.292106] RBP: ffff929a6b70c000 R08: 000000010234cd4a R09: c0000000ffff7fff[37315.377501] R10: 0000000000000001 R11: ffffabe28f913a30 R12: 0000000000000000[37315.462889] R13: ffff92992716600c R14: ffff929964e6e030 R15: ffff92991dd70000[37315.548286] FS:  0000000000000000(0000) GS:ffff92b87fb80000(0000) knlGS:0000000000000000[37315.645111] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033[37315.713871] CR2: 0000000000000050 CR3: 0000002208810006 CR4: 00000000000606e0[37315.799267] Call Trace:[37315.828515]  nvme_update_ns_info+0x1ac/0x250 [nvme_core][37315.892075]  nvme_validate_or_alloc_ns+0x2ff/0xa00 [nvme_core][37315.961871]  ? __blk_mq_free_request+0x6b/0x90[37316.015021]  nvme_scan_work+0x151/0x240 [nvme_core][37316.073371]  process_one_work+0x1a7/0x360[37316.121318]  ? create_worker+0x1a0/0x1a0[37316.168227]  worker_thread+0x30/0x390[37316.212024]  ? create_worker+0x1a0/0x1a0[37316.258939]  kthread+0x10a/0x120[37316.297557]  ? set_kthread_struct+0x50/0x50[37316.347590]  ret_from_fork+0x35/0x40[37316.390360] Modules linked in: nvme_rdma nvme_tcp(X) nvme_fabrics nvme_core netconsole iscsi_tcp libiscsi_tcp dm_queue_length dm_service_time nf_conntrack_netlink br_netfilter bridge stp llc overlay nft_chain_nat ipt_MASQUERADE nf_nat xt_addrtype xt_CT nft_counter xt_state xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 xt_comment xt_multiport nft_compat nf_tables libcrc32c nfnetlink dm_multipath tg3 rpcrdma sunrpc rdma_ucm ib_srpt ib_isert iscsi_target_mod target_core_mod ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm intel_rapl_msr iTCO_wdt iTCO_vendor_support dcdbas intel_rapl_common sb_edac x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel ipmi_ssif kvm irqbypass crct10dif_pclmul crc32_pclmul mlx5_ib ghash_clmulni_intel ib_uverbs rapl intel_cstate intel_uncore ib_core ipmi_si joydev mei_me pcspkr ipmi_devintf mei lpc_ich wmi ipmi_msghandler acpi_power_meter ex---truncated---
 漏洞公开时间：2024-10-22 04:15:11
 漏洞创建时间：2024-10-22 05:03:52
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2022-49003
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/5b566d09ab1b975566a53f9c5466ee260d087582 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/787d81d4eb150e443e5d1276c6e8f03cfecc2302 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/899d2a05dc14733cfba6224083c6b0dd5a738590 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-49003 | https://bugzilla.suse.com/show_bug.cgi?id=1232136 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2022-49003 | https://bugzilla.suse.com/show_bug.cgi?id=1232136 |
| suse_bugzilla | https://git.kernel.org/stable/c/5b566d09ab1b975566a53f9c5466ee260d087582 | https://bugzilla.suse.com/show_bug.cgi?id=1232136 |
| suse_bugzilla | https://git.kernel.org/stable/c/787d81d4eb150e443e5d1276c6e8f03cfecc2302 | https://bugzilla.suse.com/show_bug.cgi?id=1232136 |
| suse_bugzilla | https://git.kernel.org/stable/c/899d2a05dc14733cfba6224083c6b0dd5a738590 | https://bugzilla.suse.com/show_bug.cgi?id=1232136 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2022/CVE-2022-49003.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1232136 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2320714 | https://bugzilla.suse.com/show_bug.cgi?id=1232136 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2024102150-CVE-2022-49003-482c@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2320714 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2022-49003 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://git.kernel.org/stable/c/5b566d09ab1b975566a53f9c5466ee260d087582 |  | nvd |
|  |  | https://git.kernel.org/stable/c/787d81d4eb150e443e5d1276c6e8f03cfecc2302 |  | nvd |
|  |  | https://git.kernel.org/stable/c/899d2a05dc14733cfba6224083c6b0dd5a738590 |  | nvd |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:nvme: fix SRCU protection of nvme_ns_head listWalking the nvme_ns_head siblings list is protected by the head s srcuin nvme_ns_head_submit_bio() but not nvme_mpath_revalidate_paths().Removing namespaces from the list also fails to synchronize the srcu.Concurrent scan work can therefore cause use-after-frees.Hold the head s srcu lock in nvme_mpath_revalidate_paths() andsynchronize with the srcu, not the global RCU, in nvme_ns_remove().Observed the following panic when making NVMe/RDMA connectionswith native multipath on the Rocky Linux 8.6 kernel(it seems the upstream kernel has the same race condition).Disassembly shows the faulting instruction is cmp 0x50(%rdx),%rcx;computing capacity != get_capacity(ns->disk).Address 0x50 is dereferenced because ns->disk is NULL.The NULL disk appears to be the result of concurrent scan workfreeing the namespace (note the log line in the middle of the panic).[37314.206036] BUG: unable to handle kernel NULL pointer dereference at 0000000000000050[37314.206036] nvme0n3: detected capacity change from 0 to 11811160064[37314.299753] PGD 0 P4D 0[37314.299756] Oops: 0000 [#1] SMP PTI[37314.299759] CPU: 29 PID: 322046 Comm: kworker/u98:3 Kdump: loaded Tainted: G        W      X --------- -  - 4.18.0-372.32.1.el8test86.x86_64 #1[37314.299762] Hardware name: Dell Inc. PowerEdge R720/0JP31P, BIOS 2.7.0 05/23/2018[37314.299763] Workqueue: nvme-wq nvme_scan_work [nvme_core][37314.299783] RIP: 0010:nvme_mpath_revalidate_paths+0x26/0xb0 [nvme_core][37314.299790] Code: 1f 44 00 00 66 66 66 66 90 55 53 48 8b 5f 50 48 8b 83 c8 c9 00 00 48 8b 13 48 8b 48 50 48 39 d3 74 20 48 8d 42 d0 48 8b 50 20 <48> 3b 4a 50 74 05 f0 80 60 70 ef 48 8b 50 30 48 8d 42 d0 48 39 d3[37315.058803] RSP: 0018:ffffabe28f913d10 EFLAGS: 00010202[37315.121316] RAX: ffff927a077da800 RBX: ffff92991dd70000 RCX: 0000000001600000[37315.206704] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff92991b719800[37315.292106] RBP: ffff929a6b70c000 R08: 000000010234cd4a R09: c0000000ffff7fff[37315.377501] R10: 0000000000000001 R11: ffffabe28f913a30 R12: 0000000000000000[37315.462889] R13: ffff92992716600c R14: ffff929964e6e030 R15: ffff92991dd70000[37315.548286] FS:  0000000000000000(0000) GS:ffff92b87fb80000(0000) knlGS:0000000000000000[37315.645111] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033[37315.713871] CR2: 0000000000000050 CR3: 0000002208810006 CR4: 00000000000606e0[37315.799267] Call Trace:[37315.828515]  nvme_update_ns_info+0x1ac/0x250 [nvme_core][37315.892075]  nvme_validate_or_alloc_ns+0x2ff/0xa00 [nvme_core][37315.961871]  ? __blk_mq_free_request+0x6b/0x90[37316.015021]  nvme_scan_work+0x151/0x240 [nvme_core][37316.073371]  process_one_work+0x1a7/0x360[37316.121318]  ? create_worker+0x1a0/0x1a0[37316.168227]  worker_thread+0x30/0x390[37316.212024]  ? create_worker+0x1a0/0x1a0[37316.258939]  kthread+0x10a/0x120[37316.297557]  ? set_kthread_struct+0x50/0x50[37316.347590]  ret_from_fork+0x35/0x40[37316.390360] Modules linked in: nvme_rdma nvme_tcp(X) nvme_fabrics nvme_core netconsole iscsi_tcp libiscsi_tcp dm_queue_length dm_service_time nf_conntrack_netlink br_netfilter bridge stp llc overlay nft_chain_nat ipt_MASQUERADE nf_nat xt_addrtype xt_CT nft_counter xt_state xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 xt_comment xt_multiport nft_compat nf_tables libcrc32c nfnetlink dm_multipath tg3 rpcrdma sunrpc rdma_ucm ib_srpt ib_isert iscsi_target_mod target_core_mod ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm intel_rapl_msr iTCO_wdt iTCO_vendor_support dcdbas intel_rapl_common sb_edac x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel ipmi_ssif kvm irqbypass crct10dif_pclmul crc32_pclmul mlx5_ib ghash_clmulni_intel ib_uverbs rapl intel_cstate intel_uncore ib_core ipmi_si joydev mei_me pcspkr ipmi_devintf mei lpc_ich wmi ipmi_msghandler acpi_power_meter ex---truncated---
 openEuler评分：
  4.7
 Vector：CVSS：3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(4.19.90):不受影响
2.openEuler-22.03-LTS-SP1(5.10.0):不受影响
3.openEuler-22.03-LTS-SP3(5.10.0):不受影响
4.openEuler-22.03-LTS-SP4(5.10.0):不受影响
5.master(6.6.0):不受影响
6.openEuler-24.03-LTS(6.6.0):不受影响
7.openEuler-24.03-LTS-Next(6.6.0):不受影响
8.openEuler-24.03-LTS-SP1:不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1(5.10.0):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.master(6.6.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-22.03-LTS-SP4(5.10.0):否
8.openEuler-24.03-LTS-SP1:否

原因说明：
  1.openEuler-20.03-LTS-SP4(4.19.90):不受影响-漏洞代码不存在
2.openEuler-22.03-LTS-SP1(5.10.0):不受影响-漏洞代码不存在
3.openEuler-22.03-LTS-SP3(5.10.0):不受影响-漏洞代码不存在
4.openEuler-22.03-LTS-SP4(5.10.0):不受影响-漏洞代码不存在
5.master(6.6.0):不受影响-漏洞代码不存在
6.openEuler-24.03-LTS(6.6.0):不受影响-漏洞代码不存在
7.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不存在
8.openEuler-24.03-LTS-SP1:不受影响-漏洞代码不存在

src-openEuler / kernel
Closed

Content Risk Flag

Comments (10)

src-openEuler / kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2022-49003

Comments (10)

Search

src-openEuler / kernel
Closed