misc: fastrpc: Fix use-after-free race condition for maps
Published Aug 21, 2024
7.8
HIGHCVSS 3.1
EPSS 0.24%
Description
It is possible that in between calling fastrpc_map_get() until map->fl->lock is taken in fastrpc_free_map(), another thread can call fastrpc_map_lookup() and get a reference to a map that is about to be deleted.
Rewrite fastrpc_map_get() to only increase the reference count of a map if it's non-zero. Propagate this to callers so they can know if a map is about to be deleted.
Fixes this warning: refcount_t: addition on 0; use-after-free. WARNING: CPU: 5 PID: 10100 at lib/refcount.c:25 refcount_warn_saturate ... Call trace: refcount_warn_saturate [fastrpc_map_get inlined] [fastrpc_map_lookup inlined] fastrpc_map_create fastrpc_internal_invoke fastrpc_device_ioctl __arm64_sys_ioctl invoke_syscall
Affected products
-
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version
-
- Version 5.1StatusaffectedConstraints-
- Version 0StatusunaffectedConstraints<5.1
- Version 5.10.165StatusunaffectedConstraints<=5.10.*
- Version 5.15.90StatusunaffectedConstraints<=5.15.*
- Version 5.4.230StatusunaffectedConstraints<=5.4.*
- Version 6.1.8StatusunaffectedConstraints<=6.1.*
- Version 6.2StatusunaffectedConstraints<=*
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux | unaffected |
| ||||||||||||||||||||||||
| Linux | Linux | affected |
|
- ≥ 5.1 · < 5.4.230
- ≥ 5.5 · < 5.10.165
- ≥ 5.11 · < 5.15.90
- ≥ 5.16 · < 6.2
- 6.2
- 6.2
- 6.2
- 6.2
No data.
Red Hat Enterprise Linux 6
kernel
Not affected
Red Hat Enterprise Linux 7
kernel
Not affected
Red Hat Enterprise Linux 7
kernel-rt
Not affected
Red Hat Enterprise Linux 8
kernel
Not affected
Red Hat Enterprise Linux 8
kernel-rt
Not affected
Red Hat Enterprise Linux 9
kernel
Not affected
Red Hat Enterprise Linux 9
kernel-rt
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 6 | kernel | Not affected | n/a |
| Red Hat Enterprise Linux 7 | kernel | Not affected | n/a |
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | n/a |
| Red Hat Enterprise Linux 8 | kernel | Not affected | n/a |
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | n/a |
| Red Hat Enterprise Linux 9 | kernel | Not affected | n/a |
| Red Hat Enterprise Linux 9 | kernel-rt | Not affected | n/a |
No package ranges for this CVE.
Remediation
Red Hat statement
Red Hat Enterprise Linux is not impacted by this CVE, as the vulnerability in question does not affect the specific versions or configurations of the Linux kernel used in its distributions. This ensures that users of Red Hat Enterprise Linux are not exposed to the potential risks associated with this issue, and no further action or mitigation is necessary for systems running this operating system.
Red Hat mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
References (10)
- https://access.redhat.com/security/cve/CVE-2022-48872 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2306393 Issue Tracking
- https://git.kernel.org/stable/c/079c78c68714f7d8d58e66c477b0243b31806907 Patch
- https://git.kernel.org/stable/c/556dfdb226ce1e5231d8836159b23f8bb0395bf4 Patch
- https://git.kernel.org/stable/c/61a0890cb95afec5c8a2f4a879de2b6220984ef1 Patch
- https://git.kernel.org/stable/c/96b328d119eca7563c1edcc4e1039a62e6370ecb Patch
- https://git.kernel.org/stable/c/b171d0d2cf1b8387c72c8d325c5d5746fa271e39 Patch
- https://lore.kernel.org/linux-cve-announce/2024082106-CVE-2022-48872-6010@gregkh/T
- https://nvd.nist.gov/vuln/detail/CVE-2022-48872
- https://www.cve.org/CVERecord?id=CVE-2022-48872
Change history (0)
No recorded changes yet.