PT-2024-10531 · Linux+3 · Linux Kernel+3

Published 2022-01-24 · Updated 2025-01-20 · CVE-2022-48823

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.18.0-305.el8.x86 64

Description The vulnerability is related to a ref count issue in the scsi: qedf component of the Linux kernel. When a LOGO request is received during TMF, it can cause one of the I/Os to hang with the driver. This issue can lead to a denial of service. The vulnerability is identified by a hung task call trace seen during LOGO processing.

Recommendations To resolve the issue, update the Linux kernel to a version that includes the fix for the ref count issue, such as version 4.18.0-305.el8.x86 64 or later. If updating is not possible, consider temporarily disabling the qedf component or restricting its use to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-682

Related Identifiers

BDU:2025-01082

CVE-2022-48823

OPENSUSE-SU-2024_2947-1

OPENSUSE-SU-2024_3249-1

SUSE-SU-2024:2892-1

SUSE-SU-2024:2894-1

SUSE-SU-2024:2901-1

SUSE-SU-2024:2902-1

SUSE-SU-2024:2929-1

SUSE-SU-2024:2939-1

SUSE-SU-2024:2940-1

SUSE-SU-2024:2947-1

SUSE-SU-2024:3225-1

SUSE-SU-2024:3249-1

Affected Products

Astra Linux

Linux Kernel

Red Os

Suse

References · 1435

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48823.json · Exploit
• https://git.kernel.org/stable/c/7cc32ff0cd6c44a3c26de5faecfe8b5546198fad · Patch
• https://osv.dev/vulnerability/SUSE-SU-2024:2892-1 · Vendor Advisory
• https://git.kernel.org/stable/c/6be8eaad75ca73131e2a697f0270dc8ee73814a8 · Patch
• https://security-tracker.debian.org/tracker/CVE-2022-48823 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:3249-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-48823 · Security Note
• https://git.kernel.org/stable/c/5239ab63f17cee643bd4bf6addfedebaa7d4f41e · Patch
• https://git.kernel.org/stable/c/87f187e5265bc8e3b38faef8b9db864cdd61dde7 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2024:2929-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:3225-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-48823 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:2894-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-48823 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:2939-1 · Vendor Advisory