CVE-2022-49201

一、漏洞信息
 漏洞编号：[CVE-2022-49201](https://nvd.nist.gov/vuln/detail/CVE-2022-49201)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.1.8,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：4.7 Medium
  Vector：CVSS：3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:ibmvnic: fix race between xmit and resetThere is a race between reset and the transmit paths that can lead toibmvnic_xmit() accessing an scrq after it has been freed in the resetpath. It can result in a crash like:	Kernel attempted to read user page (0) - exploit attempt? (uid: 0)	BUG: Kernel NULL pointer dereference on read at 0x00000000	Faulting instruction address: 0xc0080000016189f8	Oops: Kernel access of bad area, sig: 11 [#1]	...	NIP [c0080000016189f8] ibmvnic_xmit+0x60/0xb60 [ibmvnic]	LR [c000000000c0046c] dev_hard_start_xmit+0x11c/0x280	Call Trace:	[c008000001618f08] ibmvnic_xmit+0x570/0xb60 [ibmvnic] (unreliable)	[c000000000c0046c] dev_hard_start_xmit+0x11c/0x280	[c000000000c9cfcc] sch_direct_xmit+0xec/0x330	[c000000000bfe640] __dev_xmit_skb+0x3a0/0x9d0	[c000000000c00ad4] __dev_queue_xmit+0x394/0x730	[c008000002db813c] __bond_start_xmit+0x254/0x450 [bonding]	[c008000002db8378] bond_start_xmit+0x40/0xc0 [bonding]	[c000000000c0046c] dev_hard_start_xmit+0x11c/0x280	[c000000000c00ca4] __dev_queue_xmit+0x564/0x730	[c000000000cf97e0] neigh_hh_output+0xd0/0x180	[c000000000cfa69c] ip_finish_output2+0x31c/0x5c0	[c000000000cfd244] __ip_queue_xmit+0x194/0x4f0	[c000000000d2a3c4] __tcp_transmit_skb+0x434/0x9b0	[c000000000d2d1e0] __tcp_retransmit_skb+0x1d0/0x6a0	[c000000000d2d984] tcp_retransmit_skb+0x34/0x130	[c000000000d310e8] tcp_retransmit_timer+0x388/0x6d0	[c000000000d315ec] tcp_write_timer_handler+0x1bc/0x330	[c000000000d317bc] tcp_write_timer+0x5c/0x200	[c000000000243270] call_timer_fn+0x50/0x1c0	[c000000000243704] __run_timers.part.0+0x324/0x460	[c000000000243894] run_timer_softirq+0x54/0xa0	[c000000000ea713c] __do_softirq+0x15c/0x3e0	[c000000000166258] __irq_exit_rcu+0x158/0x190	[c000000000166420] irq_exit+0x20/0x40	[c00000000002853c] timer_interrupt+0x14c/0x2b0	[c000000000009a00] decrementer_common_virt+0x210/0x220	--- interrupt: 900 at plpar_hcall_norets_notrace+0x18/0x2cThe immediate cause of the crash is the access of tx_scrq in the followingsnippet during a reset, where the tx_scrq can be either NULL or an addressthat will soon be invalid:	ibmvnic_xmit()	{		...		tx_scrq = adapter->tx_scrq[queue_num];		txq = netdev_get_tx_queue(netdev, queue_num);		ind_bufp = &tx_scrq->ind_buf;		if (test_bit(0, &adapter->resetting)) {		...	}But beyond that, the call to ibmvnic_xmit() itself is not safe during areset and the reset path attempts to avoid this by stopping the queue inibmvnic_cleanup(). However just after the queue was stopped, an in-flightibmvnic_complete_tx() could have restarted the queue even as the reset isprogressing.Since the queue was restarted we could get a call to ibmvnic_xmit() whichcan then access the bad tx_scrq (or other fields).We cannot however simply have ibmvnic_complete_tx() check the ->resettingbit and skip starting the queue. This can race at the  back-end  of a goodreset which just restarted the queue but has not cleared the ->resettingbit yet. If we skip restarting the queue due to ->resetting being true,the queue would remain stopped indefinitely potentially leading to transmittimeouts.IOW ->resetting is too broad for this purpose. Instead use a new flagthat indicates whether or not the queues are active. Only the open/reset paths control when the queues are active. ibmvnic_complete_tx()and others wake up the queue only if the queue is marked active.So we will have:	A. reset/open thread in ibmvnic_cleanup() and __ibmvnic_open()		->resetting = true		->tx_queues_active = false		disable tx queues		...		->tx_queues_active = true		start tx queues	B. Tx interrupt in ibmvnic_complete_tx():		if (->tx_queues_active)			netif_wake_subqueue();To ensure that ->tx_queues_active and state of the queues are consistent,we need a lock which:	- must also be taken in the interrupt path (ibmvnic_complete_tx())	- shared across the multiple---truncated---
 漏洞公开时间：2025-02-26 15:00:57
 漏洞创建时间：2025-02-26 16:58:16
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2022-49201
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/1bd58abf595b6cf1ba6dd47ec887c4c009155fc9 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/4219196d1f662cb10a462eb9e076633a3fc31a15 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/475f9cce98b63bc145b4efa66fa51175d4cb345f |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/8507c6ade73cdbbbda5c3d31d67f52f2e1cf03fe |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-49201 | https://bugzilla.suse.com/show_bug.cgi?id=1238256 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2022/CVE-2022-49201.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1238256 |
| suse_bugzilla | https://git.kernel.org/stable/c/1bd58abf595b6cf1ba6dd47ec887c4c009155fc9 | https://bugzilla.suse.com/show_bug.cgi?id=1238256 |
| suse_bugzilla | https://git.kernel.org/stable/c/475f9cce98b63bc145b4efa66fa51175d4cb345f | https://bugzilla.suse.com/show_bug.cgi?id=1238256 |
| suse_bugzilla | https://git.kernel.org/stable/c/8507c6ade73cdbbbda5c3d31d67f52f2e1cf03fe | https://bugzilla.suse.com/show_bug.cgi?id=1238256 |
| suse_bugzilla | https://git.kernel.org/stable/c/4219196d1f662cb10a462eb9e076633a3fc31a15 | https://bugzilla.suse.com/show_bug.cgi?id=1238256 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2348046 | https://bugzilla.suse.com/show_bug.cgi?id=1238256 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://git.kernel.org/stable/c/1bd58abf595b6cf1ba6dd47ec887c4c009155fc9 |  | nvd |
|  |  | https://git.kernel.org/stable/c/4219196d1f662cb10a462eb9e076633a3fc31a15 |  | nvd |
|  |  | https://git.kernel.org/stable/c/475f9cce98b63bc145b4efa66fa51175d4cb345f |  | nvd |
|  |  | https://git.kernel.org/stable/c/8507c6ade73cdbbbda5c3d31d67f52f2e1cf03fe |  | nvd |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:ibmvnic: fix race between xmit and resetThere is a race between reset and the transmit paths that can lead toibmvnic_xmit() accessing an scrq after it has been freed in the resetpath. It can result in a crash like:Kernel attempted to read user page (0) - exploit attempt? (uid: 0)BUG: Kernel NULL pointer dereference on read at 0x00000000Faulting instruction address: 0xc0080000016189f8Oops: Kernel access of bad area, sig: 11 [#1]...NIP [c0080000016189f8] ibmvnic_xmit+0x60/0xb60 [ibmvnic]LR [c000000000c0046c] dev_hard_start_xmit+0x11c/0x280Call Trace:[c008000001618f08] ibmvnic_xmit+0x570/0xb60 [ibmvnic] (unreliable)[c000000000c0046c] dev_hard_start_xmit+0x11c/0x280[c000000000c9cfcc] sch_direct_xmit+0xec/0x330[c000000000bfe640] __dev_xmit_skb+0x3a0/0x9d0[c000000000c00ad4] __dev_queue_xmit+0x394/0x730[c008000002db813c] __bond_start_xmit+0x254/0x450 [bonding][c008000002db8378] bond_start_xmit+0x40/0xc0 [bonding][c000000000c0046c] dev_hard_start_xmit+0x11c/0x280[c000000000c00ca4] __dev_queue_xmit+0x564/0x730[c000000000cf97e0] neigh_hh_output+0xd0/0x180[c000000000cfa69c] ip_finish_output2+0x31c/0x5c0[c000000000cfd244] __ip_queue_xmit+0x194/0x4f0[c000000000d2a3c4] __tcp_transmit_skb+0x434/0x9b0[c000000000d2d1e0] __tcp_retransmit_skb+0x1d0/0x6a0[c000000000d2d984] tcp_retransmit_skb+0x34/0x130[c000000000d310e8] tcp_retransmit_timer+0x388/0x6d0[c000000000d315ec] tcp_write_timer_handler+0x1bc/0x330[c000000000d317bc] tcp_write_timer+0x5c/0x200[c000000000243270] call_timer_fn+0x50/0x1c0[c000000000243704] __run_timers.part.0+0x324/0x460[c000000000243894] run_timer_softirq+0x54/0xa0[c000000000ea713c] __do_softirq+0x15c/0x3e0[c000000000166258] __irq_exit_rcu+0x158/0x190[c000000000166420] irq_exit+0x20/0x40[c00000000002853c] timer_interrupt+0x14c/0x2b0[c000000000009a00] decrementer_common_virt+0x210/0x220--- interrupt: 900 at plpar_hcall_norets_notrace+0x18/0x2cThe immediate cause of the crash is the access of tx_scrq in the followingsnippet during a reset, where the tx_scrq can be either NULL or an addressthat will soon be invalid:ibmvnic_xmit(){...tx_scrq = adapter->tx_scrq[queue_num];txq = netdev_get_tx_queue(netdev, queue_num);ind_bufp = &tx_scrq->ind_buf;if (test_bit(0, &adapter->resetting)) {...}But beyond that, the call to ibmvnic_xmit() itself is not safe during areset and the reset path attempts to avoid this by stopping the queue inibmvnic_cleanup(). However just after the queue was stopped, an in-flightibmvnic_complete_tx() could have restarted the queue even as the reset isprogressing.Since the queue was restarted we could get a call to ibmvnic_xmit() whichcan then access the bad tx_scrq (or other fields).We cannot however simply have ibmvnic_complete_tx() check the ->resettingbit and skip starting the queue. This can race at the  back-end  of a goodreset which just restarted the queue but has not cleared the ->resettingbit yet. If we skip restarting the queue due to ->resetting being true,the queue would remain stopped indefinitely potentially leading to transmittimeouts.IOW ->resetting is too broad for this purpose. Instead use a new flagthat indicates whether or not the queues are active. Only the open/reset paths control when the queues are active. ibmvnic_complete_tx()and others wake up the queue only if the queue is marked active.So we will have:A. reset/open thread in ibmvnic_cleanup() and __ibmvnic_open()->resetting = true->tx_queues_active = falsedisable tx queues...->tx_queues_active = truestart tx queuesB. Tx interrupt in ibmvnic_complete_tx():if (->tx_queues_active)netif_wake_subqueue();To ensure that ->tx_queues_active and state of the queues are consistent,we need a lock which:- must also be taken in the interrupt path (ibmvnic_complete_tx())- shared across the multiple---truncated---
 openEuler评分：
  4.7
 Vector：CVSS：3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-22.03-LTS-SP3(5.10.0):受影响
2.openEuler-22.03-LTS-SP4(5.10.0):受影响
3.openEuler-20.03-LTS-SP4(4.19.90):不受影响
4.master(6.6.0):不受影响
5.openEuler-24.03-LTS(6.6.0):不受影响
6.openEuler-24.03-LTS-Next(6.6.0):不受影响
7.openEuler-24.03-LTS-SP1(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP3(5.10.0):否
3.master(6.6.0):否
4.openEuler-24.03-LTS(6.6.0):否
5.openEuler-24.03-LTS-Next(6.6.0):否
6.openEuler-22.03-LTS-SP4(5.10.0):否
7.openEuler-24.03-LTS-SP1(6.6.0):否

原因说明：
  1.openEuler-22.03-LTS-SP3(5.10.0):不修复-超出修复范围
2.openEuler-22.03-LTS-SP4(5.10.0):不修复-超出修复范围
3.master(6.6.0):不受影响-漏洞代码不能被攻击者触发
4.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发
5.openEuler-20.03-LTS-SP4(4.19.90):不受影响-漏洞代码不存在
6.openEuler-24.03-LTS(6.6.0):不受影响-漏洞代码不存在
7.openEuler-24.03-LTS-SP1(6.6.0):不受影响-漏洞代码不存在

src-openEuler / kernel
Closed

Content Risk Flag

Comments (8)

src-openEuler / kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2022-49201

Comments (8)

Search

src-openEuler / kernel
Closed