PT-2022-7643 · Linux+3 · Linux Kernel+3
Sagi Grimberg
·
Published
2022-02-02
·
Updated
2025-01-08
·
CVE-2022-48790
CVSS v3.1
7.0
High
| Vector | AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The issue is related to a possible use-after-free condition in the Linux kernel's NVMe driver. This condition may occur when the driver executes its reset ctrl work and the ctrl sends an AEN, which is received by the host and schedules AEN handling. The race condition may happen in a specific scenario where the driver attempts to send a command after the ctrl state has been changed to RESETTING. To fix this, a ctrl state check has been added to validate that the ctrl is actually able to accept the AER submission.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Linux Kernel
Red Os
Suse