CVE-2022-48788

In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: fix possible use-after-free in transport error_recovery work While nvme_rdma_submit_async_event_work is checking the ctrl and queue state before preparing the AER command and scheduling io_work, in order to fully prevent a race where this check is not reliable the error recovery work must flush async_event_work before continuing to destroy the admin queue after setting the ctrl state to RESETTING such that there is no race .submit_async_event and the error recovery handler itself changing the ctrl state.

CVSS

No CVSS.

References

Link	Resource
https://git.kernel.org/stable/c/324f5bdc52ecb6a6dadb31a62823ef8c709d1439
https://git.kernel.org/stable/c/5593f72d1922403c11749532e3a0aa4cf61414e9
https://git.kernel.org/stable/c/646952b2210f19e584d2bf9eb5d092abdca2fcc1
https://git.kernel.org/stable/c/b6bb1722f34bbdbabed27acdceaf585d300c5fd2
https://git.kernel.org/stable/c/d411b2a5da68b8a130c23097014434ac140a2ace
https://git.kernel.org/stable/c/ea86027ac467a055849c4945906f799e7f65ab99

Configurations

No configuration.

History

No history.

Information

Published : 2024-07-16 12:15

Updated : 2024-07-16 13:43

NVD link : CVE-2022-48788

Mitre link : CVE-2022-48788

CVE.ORG link : CVE-2022-48788

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2022-48788", "cveTags": [], "metrics": {}, "published": "2024-07-16T12:15:03.703", "references": [{"url": "https://git.kernel.org/stable/c/324f5bdc52ecb6a6dadb31a62823ef8c709d1439", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/5593f72d1922403c11749532e3a0aa4cf61414e9", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/646952b2210f19e584d2bf9eb5d092abdca2fcc1", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/b6bb1722f34bbdbabed27acdceaf585d300c5fd2", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/d411b2a5da68b8a130c23097014434ac140a2ace", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/ea86027ac467a055849c4945906f799e7f65ab99", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Awaiting Analysis", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-rdma: fix possible use-after-free in transport error_recovery work\n\nWhile nvme_rdma_submit_async_event_work is checking the ctrl and queue\nstate before preparing the AER command and scheduling io_work, in order\nto fully prevent a race where this check is not reliable the error\nrecovery work must flush async_event_work before continuing to destroy\nthe admin queue after setting the ctrl state to RESETTING such that\nthere is no race .submit_async_event and the error recovery handler\nitself changing the ctrl state."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nvme-rdma: soluciona el posible use-after-free en el transporte error_recovery work Mientras nvme_rdma_submit_async_event_work verifica el control y el estado de la cola antes de preparar el comando AER y programar io_work, para evitar completamente una ejecuci\u00f3n donde esta verificaci\u00f3n no es confiable, el trabajo de recuperaci\u00f3n de errores debe eliminar async_event_work antes de continuar destruyendo la cola de administraci\u00f3n despu\u00e9s de configurar el estado de control en RESETTING de manera que no haya ejecuci\u00f3n .submit_async_event y el propio controlador de recuperaci\u00f3n de errores cambie el estado de control."}], "lastModified": "2024-07-16T13:43:58.773", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}