PT-2022-7636 · Linux+1 · Linux Kernel+1

Dave Jiang + 2 · Published 2022-12-28 · Updated 2024-09-24 · CVE-2022-48867

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to a use-after-free vulnerability in the Linux kernel's dmaengine subsystem, specifically in the idxd driver. When the driver is unloaded, any pending descriptors are flushed, which can trigger a "not present" page fault if the descriptors have already been freed. This is caused by the flow of functions: idxd dmaengine drv remove() -> drv disable wq() -> idxd wq free irq() -> idxd flush pending descs(). The address that triggers the fault is the address of the descriptor that was freed moments earlier via drv disable wq()->idxd wq free resources(). The fix involves freeing the descriptors after any possible usage, done after idxd wq reset() to ensure the memory remains accessible during possible completion writes by the device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use After Free

Memory Leak

Weakness Enumeration

CWE-416

CWE-401

Related Identifiers

BDU:2024-07600

CVE-2022-48867

OESA-2024-2125

OESA-2024-2126

Affected Products

Linux Kernel

Red Os

References · 44

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48867.json · Exploit
• https://git.kernel.org/stable/c/b9e8e3fcfec625fc1c2f68f684448aeeb882625b · Patch
• https://security-tracker.debian.org/tracker/CVE-2022-48867 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-43914 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-52754 · Security Note
• https://osv.dev/vulnerability/CVE-2022-48867 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-43907 · Security Note
• https://git.kernel.org/stable/c/1beeec45f9ac31eba52478379f70a5fa9c2ad005 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-48887 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-48867 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-42276 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-36934 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-44971 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-45896 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-52488 · Security Note