PT-2022-7497 · Linux+3 · Linux Kernel+3

Syzbot · Published 2022-02-15 · Updated 2024-09-27 · CVE-2022-48937

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Linux kernel version 5.17.0-smp-DEV #801

Description The vulnerability is related to the io uring component in the Linux kernel. Looping approximately 65535 times doing kmalloc() calls can trigger soft lockups, especially with DEBUG features enabled, such as KASAN. This issue can cause a denial of service.

Recommendations To resolve this issue, update the Linux kernel to a version that includes the fix for the io uring vulnerability. Specifically, apply the patch that adds a schedule point in io add buffers() to prevent soft lockups.

Note: The provided information does not specify the exact version that includes the fix, so it is recommended to update to the latest available version of the Linux kernel.

Exploit

Fix

Improper Locking

Weakness Enumeration

CWE-667

Related Identifiers

BDU:2024-06654

CVE-2022-48937

OESA-2024-2109

OPENSUSE-SU-2024_3190-1

OPENSUSE-SU-2024_3209-1

OPENSUSE-SU-2024_3408-1

OPENSUSE-SU-2024_3483-1

SUSE-SU-2024:3190-1

SUSE-SU-2024:3209-1

SUSE-SU-2024:3227-1

SUSE-SU-2024:3408-1

SUSE-SU-2024:3483-1

Affected Products

Astra Linux

Linux Kernel

Red Os

Suse

References · 692

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48937.json · Exploit
• 🔥 https://github.com/tr3ee/CVE-2022-23222 · Exploit
• 🔥 https://github.com/tr3ee/CVE-2021-4204 · Exploit
• 🔥 https://github.com/PenteraIO/CVE-2022-23222-POC · Exploit
• https://osv.dev/vulnerability/SUSE-SU-2024:3408-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:3190-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-43900 · Security Note
• https://ubuntu.com/security/CVE-2022-48937 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-42286 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-48937 · Security Note
• https://osv.dev/vulnerability/OESA-2024-2109 · Vendor Advisory
• https://git.kernel.org/stable/c/c718ea4e7382e18957ed0e88a5f855e2122d9c00 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2024:3209-1 · Vendor Advisory
• https://git.kernel.org/stable/c/f240762f88b4b1b58561939ffd44837759756477 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-48877 · Security Note