CVE-2022-49753

一、漏洞信息
 漏洞编号：[CVE-2022-49753](https://nvd.nist.gov/vuln/detail/CVE-2022-49753)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.1.8,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：7.8 High
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:dmaengine: Fix double increment of client_count in dma_chan_get()The first time dma_chan_get() is called for a channel the channelclient_count is incorrectly incremented twice for public channels,first in balance_ref_count(), and again prior to returning. Thisresults in an incorrect client count which will lead to thechannel resources not being freed when they should be. A simple test of repeated module load and unload of async_tx on a Dell Power Edge R7425 also shows this resulting in a kref underflow warning.[  124.329662] async_tx: api initialized (async)[  129.000627] async_tx: api initialized (async)[  130.047839] ------------[ cut here ]------------[  130.052472] refcount_t: underflow; use-after-free.[  130.057279] WARNING: CPU: 3 PID: 19364 at lib/refcount.c:28refcount_warn_saturate+0xba/0x110[  130.065811] Modules linked in: async_tx(-) rfkill intel_rapl_msrintel_rapl_common amd64_edac edac_mce_amd ipmi_ssif kvm_amd dcdbas kvmmgag200 drm_shmem_helper acpi_ipmi irqbypass drm_kms_helper ipmi_sisyscopyarea sysfillrect rapl pcspkr ipmi_devintf sysimgblt fb_sys_fopsk10temp i2c_piix4 ipmi_msghandler acpi_power_meter acpi_cpufreq vfatfat drm fuse xfs libcrc32c sd_mod t10_pi sg ahci crct10dif_pclmullibahci crc32_pclmul crc32c_intel ghash_clmulni_intel igb megaraid_sasi40e libata i2c_algo_bit ccp sp5100_tco dca dm_mirror dm_region_hashdm_log dm_mod [last unloaded: async_tx][  130.117361] CPU: 3 PID: 19364 Comm: modprobe Kdump: loaded Nottainted 5.14.0-185.el9.x86_64 #1[  130.126091] Hardware name: Dell Inc. PowerEdge R7425/02MJ3T, BIOS1.18.0 01/17/2022[  130.133806] RIP: 0010:refcount_warn_saturate+0xba/0x110[  130.139041] Code: 01 01 e8 6d bd 55 00 0f 0b e9 72 9d 8a 00 80 3d26 18 9c 01 00 75 85 48 c7 c7 f8 a3 03 9d c6 05 16 18 9c 01 01 e8 4abd 55 00 <0f> 0b e9 4f 9d 8a 00 80 3d 01 18 9c 01 00 0f 85 5e ff ff ff48 c7[  130.157807] RSP: 0018:ffffbf98898afe68 EFLAGS: 00010286[  130.163036] RAX: 0000000000000000 RBX: ffff9da06028e598 RCX: 0000000000000000[  130.170172] RDX: ffff9daf9de26480 RSI: ffff9daf9de198a0 RDI: ffff9daf9de198a0[  130.177316] RBP: ffff9da7cddf3970 R08: 0000000000000000 R09: 00000000ffff7fff[  130.184459] R10: ffffbf98898afd00 R11: ffffffff9d9e8c28 R12: ffff9da7cddf1970[  130.191596] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000[  130.198739] FS:  00007f646435c740(0000) GS:ffff9daf9de00000(0000)knlGS:0000000000000000[  130.206832] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033[  130.212586] CR2: 00007f6463b214f0 CR3: 00000008ab98c000 CR4: 00000000003506e0[  130.219729] Call Trace:[  130.222192]  <TASK>[  130.224305]  dma_chan_put+0x10d/0x110[  130.227988]  dmaengine_put+0x7a/0xa0[  130.231575]  __do_sys_delete_module.constprop.0+0x178/0x280[  130.237157]  ? syscall_trace_enter.constprop.0+0x145/0x1d0[  130.242652]  do_syscall_64+0x5c/0x90[  130.246240]  ? exc_page_fault+0x62/0x150[  130.250178]  entry_SYSCALL_64_after_hwframe+0x63/0xcd[  130.255243] RIP: 0033:0x7f6463a3f5ab[  130.258830] Code: 73 01 c3 48 8b 0d 75 a8 1b 00 f7 d8 64 89 01 4883 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 b0 00 0000 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 45 a8 1b 00 f7 d8 64 8901 48[  130.277591] RSP: 002b:00007fff22f972c8 EFLAGS: 00000206 ORIG_RAX:00000000000000b0[  130.285164] RAX: ffffffffffffffda RBX: 000055b6786edd40 RCX: 00007f6463a3f5ab[  130.292303] RDX: 0000000000000000 RSI: 0000000000000800 RDI: 000055b6786edda8[  130.299443] RBP: 000055b6786edd40 R08: 0000000000000000 R09: 0000000000000000[  130.306584] R10: 00007f6463b9eac0 R11: 0000000000000206 R12: 000055b6786edda8[  130.313731] R13: 0000000000000000 R14: 000055b6786edda8 R15: 00007fff22f995f8[  130.320875]  </TASK>[  130.323081] ---[ end trace eff7156d56b5cf25 ]---cat /sys/class/dma/dma0chan*/in_use would get the wrong result.222Test-by: Jie Hai <haijie1@huawei.com>
 漏洞公开时间：2025-03-28 01:15:40
 漏洞创建时间：2025-03-28 02:05:33
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2022-49753
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/142d644fd2cc059ffa042fbfb68e766433ef3afd |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/18dd3b30d4c7e8440c63118c7a7b687372b9567f |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/1b409e14b4b7af034e0450f95c165b6c5c87dbc1 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/42ecd72f02cd657b00b559621e7ef7d2c4d3e5f1 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/71c601965532c38030133535f7cd93c1efa75af1 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/c6221afe573413fd2981e291f7df4a58283e0654 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/f3dc1b3b4750851a94212dba249703dd0e50bb20 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-49753 | https://bugzilla.suse.com/show_bug.cgi?id=1240250 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2022/CVE-2022-49753.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1240250 |
| suse_bugzilla | https://git.kernel.org/stable/c/1b409e14b4b7af034e0450f95c165b6c5c87dbc1 | https://bugzilla.suse.com/show_bug.cgi?id=1240250 |
| suse_bugzilla | https://git.kernel.org/stable/c/c6221afe573413fd2981e291f7df4a58283e0654 | https://bugzilla.suse.com/show_bug.cgi?id=1240250 |
| suse_bugzilla | https://git.kernel.org/stable/c/18dd3b30d4c7e8440c63118c7a7b687372b9567f | https://bugzilla.suse.com/show_bug.cgi?id=1240250 |
| suse_bugzilla | https://git.kernel.org/stable/c/42ecd72f02cd657b00b559621e7ef7d2c4d3e5f1 | https://bugzilla.suse.com/show_bug.cgi?id=1240250 |
| suse_bugzilla | https://git.kernel.org/stable/c/71c601965532c38030133535f7cd93c1efa75af1 | https://bugzilla.suse.com/show_bug.cgi?id=1240250 |
| suse_bugzilla | https://git.kernel.org/stable/c/142d644fd2cc059ffa042fbfb68e766433ef3afd | https://bugzilla.suse.com/show_bug.cgi?id=1240250 |
| suse_bugzilla | https://git.kernel.org/stable/c/f3dc1b3b4750851a94212dba249703dd0e50bb20 | https://bugzilla.suse.com/show_bug.cgi?id=1240250 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2022-49753 | https://bugzilla.suse.com/show_bug.cgi?id=1240250 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://git.kernel.org/stable/c/142d644fd2cc059ffa042fbfb68e766433ef3afd |  | nvd |
|  |  | https://git.kernel.org/stable/c/18dd3b30d4c7e8440c63118c7a7b687372b9567f |  | nvd |
|  |  | https://git.kernel.org/stable/c/1b409e14b4b7af034e0450f95c165b6c5c87dbc1 |  | nvd |
|  |  | https://git.kernel.org/stable/c/42ecd72f02cd657b00b559621e7ef7d2c4d3e5f1 |  | nvd |
|  |  | https://git.kernel.org/stable/c/71c601965532c38030133535f7cd93c1efa75af1 |  | nvd |
|  |  | https://git.kernel.org/stable/c/c6221afe573413fd2981e291f7df4a58283e0654 |  | nvd |
|  |  | https://git.kernel.org/stable/c/f3dc1b3b4750851a94212dba249703dd0e50bb20 |  | nvd |
| linux_kernel | 4.14.305 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1b409e14b4b7af034e0450f95c165b6c5c87dbc1Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=d2f4f99db3e9ec8b063cf2e45704e2bb95428317 | linuxkernelcves |
| linux_kernel | 4.19.272 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=c6221afe573413fd2981e291f7df4a58283e0654Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=d2f4f99db3e9ec8b063cf2e45704e2bb95428317 | linuxkernelcves |
| linux_kernel | 5.4.231 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=18dd3b30d4c7e8440c63118c7a7b687372b9567fIssue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=d2f4f99db3e9ec8b063cf2e45704e2bb95428317 | linuxkernelcves |
| linux_kernel | 5.10.166 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=42ecd72f02cd657b00b559621e7ef7d2c4d3e5f1Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=d2f4f99db3e9ec8b063cf2e45704e2bb95428317 | linuxkernelcves |
| linux_kernel | 5.15.91 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=71c601965532c38030133535f7cd93c1efa75af1Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=d2f4f99db3e9ec8b063cf2e45704e2bb95428317 | linuxkernelcves |
| linux_kernel | 6.1.9 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=142d644fd2cc059ffa042fbfb68e766433ef3afdIssue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=d2f4f99db3e9ec8b063cf2e45704e2bb95428317 | linuxkernelcves |
| linux_kernel | 6.2 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f3dc1b3b4750851a94212dba249703dd0e50bb20Please | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=d2f4f99db3e9ec8b063cf2e45704e2bb95428317 | linuxkernelcves |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:dmaengine: Fix double increment of client_count in dma_chan_get()The first time dma_chan_get() is called for a channel the channelclient_count is incorrectly incremented twice for public channels,first in balance_ref_count(), and again prior to returning. Thisresults in an incorrect client count which will lead to thechannel resources not being freed when they should be. A simple test of repeated module load and unload of async_tx on a Dell Power Edge R7425 also shows this resulting in a kref underflow warning.[  124.329662] async_tx: api initialized (async)[  129.000627] async_tx: api initialized (async)[  130.047839] ------------[ cut here ]------------[  130.052472] refcount_t: underflow; use-after-free.[  130.057279] WARNING: CPU: 3 PID: 19364 at lib/refcount.c:28refcount_warn_saturate+0xba/0x110[  130.065811] Modules linked in: async_tx(-) rfkill intel_rapl_msrintel_rapl_common amd64_edac edac_mce_amd ipmi_ssif kvm_amd dcdbas kvmmgag200 drm_shmem_helper acpi_ipmi irqbypass drm_kms_helper ipmi_sisyscopyarea sysfillrect rapl pcspkr ipmi_devintf sysimgblt fb_sys_fopsk10temp i2c_piix4 ipmi_msghandler acpi_power_meter acpi_cpufreq vfatfat drm fuse xfs libcrc32c sd_mod t10_pi sg ahci crct10dif_pclmullibahci crc32_pclmul crc32c_intel ghash_clmulni_intel igb megaraid_sasi40e libata i2c_algo_bit ccp sp5100_tco dca dm_mirror dm_region_hashdm_log dm_mod [last unloaded: async_tx][  130.117361] CPU: 3 PID: 19364 Comm: modprobe Kdump: loaded Nottainted 5.14.0-185.el9.x86_64 #1[  130.126091] Hardware name: Dell Inc. PowerEdge R7425/02MJ3T, BIOS1.18.0 01/17/2022[  130.133806] RIP: 0010:refcount_warn_saturate+0xba/0x110[  130.139041] Code: 01 01 e8 6d bd 55 00 0f 0b e9 72 9d 8a 00 80 3d26 18 9c 01 00 75 85 48 c7 c7 f8 a3 03 9d c6 05 16 18 9c 01 01 e8 4abd 55 00 <0f> 0b e9 4f 9d 8a 00 80 3d 01 18 9c 01 00 0f 85 5e ff ff ff48 c7[  130.157807] RSP: 0018:ffffbf98898afe68 EFLAGS: 00010286[  130.163036] RAX: 0000000000000000 RBX: ffff9da06028e598 RCX: 0000000000000000[  130.170172] RDX: ffff9daf9de26480 RSI: ffff9daf9de198a0 RDI: ffff9daf9de198a0[  130.177316] RBP: ffff9da7cddf3970 R08: 0000000000000000 R09: 00000000ffff7fff[  130.184459] R10: ffffbf98898afd00 R11: ffffffff9d9e8c28 R12: ffff9da7cddf1970[  130.191596] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000[  130.198739] FS:  00007f646435c740(0000) GS:ffff9daf9de00000(0000)knlGS:0000000000000000[  130.206832] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033[  130.212586] CR2: 00007f6463b214f0 CR3: 00000008ab98c000 CR4: 00000000003506e0[  130.219729] Call Trace:[  130.222192]  <TASK>[  130.224305]  dma_chan_put+0x10d/0x110[  130.227988]  dmaengine_put+0x7a/0xa0[  130.231575]  __do_sys_delete_module.constprop.0+0x178/0x280[  130.237157]  ? syscall_trace_enter.constprop.0+0x145/0x1d0[  130.242652]  do_syscall_64+0x5c/0x90[  130.246240]  ? exc_page_fault+0x62/0x150[  130.250178]  entry_SYSCALL_64_after_hwframe+0x63/0xcd[  130.255243] RIP: 0033:0x7f6463a3f5ab[  130.258830] Code: 73 01 c3 48 8b 0d 75 a8 1b 00 f7 d8 64 89 01 4883 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 b0 00 0000 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 45 a8 1b 00 f7 d8 64 8901 48[  130.277591] RSP: 002b:00007fff22f972c8 EFLAGS: 00000206 ORIG_RAX:00000000000000b0[  130.285164] RAX: ffffffffffffffda RBX: 000055b6786edd40 RCX: 00007f6463a3f5ab[  130.292303] RDX: 0000000000000000 RSI: 0000000000000800 RDI: 000055b6786edda8[  130.299443] RBP: 000055b6786edd40 R08: 0000000000000000 R09: 0000000000000000[  130.306584] R10: 00007f6463b9eac0 R11: 0000000000000206 R12: 000055b6786edda8[  130.313731] R13: 0000000000000000 R14: 000055b6786edda8 R15: 00007fff22f995f8[  130.320875]  </TASK>[  130.323081] ---[ end trace eff7156d56b5cf25 ]---cat /sys/class/dma/dma0chan*/in_use would get the wrong result.222Test-by: Jie Hai <haijie1@huawei.com>
 openEuler评分：
  7.8
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(4.19.90):受影响
2.openEuler-22.03-LTS-SP3:不受影响
3.openEuler-22.03-LTS-SP4:不受影响
4.master:不受影响
5.openEuler-24.03-LTS:不受影响
6.openEuler-24.03-LTS-Next:不受影响
7.openEuler-24.03-LTS-SP1:不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP3:否
3.master:否
4.openEuler-24.03-LTS:否
5.openEuler-24.03-LTS-Next:否
6.openEuler-22.03-LTS-SP4:否
7.openEuler-24.03-LTS-SP1:否

原因说明：
  1.openEuler-20.03-LTS-SP4(4.19.90):正常修复
2.master:不受影响-漏洞代码不能被攻击者触发
3.openEuler-24.03-LTS-Next:不受影响-漏洞代码不能被攻击者触发
4.openEuler-22.03-LTS-SP3:不受影响-漏洞代码不存在
5.openEuler-22.03-LTS-SP4:不受影响-漏洞代码不存在
6.openEuler-24.03-LTS:不受影响-漏洞代码不存在
7.openEuler-24.03-LTS-SP1:不受影响-漏洞代码不存在

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2025-1408

src-openEuler/kernel
Closed

Content Risk Flag

Comments (10)

src-openEuler/kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2022-49753

Comments (10)

Search

src-openEuler/kernel
Closed