cve-2022-48931
Vulnerability from cvelistv5
Published
2024-08-22 03:31
Modified
2024-12-19 08:10
Severity ?
Summary
configfs: fix a race in configfs_{,un}register_subsystem()
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/3aadfd46858b1f64d4d6a0654b863e21aabff975Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/40805099af11f68c5ca7dbcfacf455da8f99f622Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/84ec758fb2daa236026506868c8796b0500c047dPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a37024f7757c25550accdebf49e497ad6ae239fePatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a7ab53d3c27dfe83bb594456b9f38a37796ec39bPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b7e2b91fcb5c78c414e33dc8d50642e307ca0c5aPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d1654de19d42f513b6cfe955cc77e7f427e05a77Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e7a66dd2687758718eddd79b542a95cf3aa488ccPatch
Impacted products
LinuxLinux
LinuxLinux
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-48931",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:32:49.740795Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:33:10.278Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/configfs/dir.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "40805099af11f68c5ca7dbcfacf455da8f99f622",
              "status": "affected",
              "version": "7063fbf2261194f72ee75afca67b3b38b554b5fa",
              "versionType": "git"
            },
            {
              "lessThan": "d1654de19d42f513b6cfe955cc77e7f427e05a77",
              "status": "affected",
              "version": "7063fbf2261194f72ee75afca67b3b38b554b5fa",
              "versionType": "git"
            },
            {
              "lessThan": "a37024f7757c25550accdebf49e497ad6ae239fe",
              "status": "affected",
              "version": "7063fbf2261194f72ee75afca67b3b38b554b5fa",
              "versionType": "git"
            },
            {
              "lessThan": "b7e2b91fcb5c78c414e33dc8d50642e307ca0c5a",
              "status": "affected",
              "version": "7063fbf2261194f72ee75afca67b3b38b554b5fa",
              "versionType": "git"
            },
            {
              "lessThan": "a7ab53d3c27dfe83bb594456b9f38a37796ec39b",
              "status": "affected",
              "version": "7063fbf2261194f72ee75afca67b3b38b554b5fa",
              "versionType": "git"
            },
            {
              "lessThan": "e7a66dd2687758718eddd79b542a95cf3aa488cc",
              "status": "affected",
              "version": "7063fbf2261194f72ee75afca67b3b38b554b5fa",
              "versionType": "git"
            },
            {
              "lessThan": "3aadfd46858b1f64d4d6a0654b863e21aabff975",
              "status": "affected",
              "version": "7063fbf2261194f72ee75afca67b3b38b554b5fa",
              "versionType": "git"
            },
            {
              "lessThan": "84ec758fb2daa236026506868c8796b0500c047d",
              "status": "affected",
              "version": "7063fbf2261194f72ee75afca67b3b38b554b5fa",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/configfs/dir.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.16"
            },
            {
              "lessThan": "2.6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.304",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.269",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.232",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.182",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.26",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nconfigfs: fix a race in configfs_{,un}register_subsystem()\n\nWhen configfs_register_subsystem() or configfs_unregister_subsystem()\nis executing link_group() or unlink_group(),\nit is possible that two processes add or delete list concurrently.\nSome unfortunate interleavings of them can cause kernel panic.\n\nOne of cases is:\nA --\u003e B --\u003e C --\u003e D\nA \u003c-- B \u003c-- C \u003c-- D\n\n     delete list_head *B        |      delete list_head *C\n--------------------------------|-----------------------------------\nconfigfs_unregister_subsystem   |   configfs_unregister_subsystem\n  unlink_group                  |     unlink_group\n    unlink_obj                  |       unlink_obj\n      list_del_init             |         list_del_init\n        __list_del_entry        |           __list_del_entry\n          __list_del            |             __list_del\n            // next == C        |\n            next-\u003eprev = prev   |\n                                |               next-\u003eprev = prev\n            prev-\u003enext = next   |\n                                |                 // prev == B\n                                |                 prev-\u003enext = next\n\nFix this by adding mutex when calling link_group() or unlink_group(),\nbut parent configfs_subsystem is NULL when config_item is root.\nSo I create a mutex configfs_subsystem_mutex."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-19T08:10:45.358Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/40805099af11f68c5ca7dbcfacf455da8f99f622"
        },
        {
          "url": "https://git.kernel.org/stable/c/d1654de19d42f513b6cfe955cc77e7f427e05a77"
        },
        {
          "url": "https://git.kernel.org/stable/c/a37024f7757c25550accdebf49e497ad6ae239fe"
        },
        {
          "url": "https://git.kernel.org/stable/c/b7e2b91fcb5c78c414e33dc8d50642e307ca0c5a"
        },
        {
          "url": "https://git.kernel.org/stable/c/a7ab53d3c27dfe83bb594456b9f38a37796ec39b"
        },
        {
          "url": "https://git.kernel.org/stable/c/e7a66dd2687758718eddd79b542a95cf3aa488cc"
        },
        {
          "url": "https://git.kernel.org/stable/c/3aadfd46858b1f64d4d6a0654b863e21aabff975"
        },
        {
          "url": "https://git.kernel.org/stable/c/84ec758fb2daa236026506868c8796b0500c047d"
        }
      ],
      "title": "configfs: fix a race in configfs_{,un}register_subsystem()",
      "x_generator": {
        "engine": "bippy-5f407fcff5a0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48931",
    "datePublished": "2024-08-22T03:31:24.823Z",
    "dateReserved": "2024-08-21T06:06:23.299Z",
    "dateUpdated": "2024-12-19T08:10:45.358Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-48931\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-08-22T04:15:16.010\",\"lastModified\":\"2024-08-23T01:54:11.640\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nconfigfs: fix a race in configfs_{,un}register_subsystem()\\n\\nWhen configfs_register_subsystem() or configfs_unregister_subsystem()\\nis executing link_group() or unlink_group(),\\nit is possible that two processes add or delete list concurrently.\\nSome unfortunate interleavings of them can cause kernel panic.\\n\\nOne of cases is:\\nA --\u003e B --\u003e C --\u003e D\\nA \u003c-- B \u003c-- C \u003c-- D\\n\\n     delete list_head *B        |      delete list_head *C\\n--------------------------------|-----------------------------------\\nconfigfs_unregister_subsystem   |   configfs_unregister_subsystem\\n  unlink_group                  |     unlink_group\\n    unlink_obj                  |       unlink_obj\\n      list_del_init             |         list_del_init\\n        __list_del_entry        |           __list_del_entry\\n          __list_del            |             __list_del\\n            // next == C        |\\n            next-\u003eprev = prev   |\\n                                |               next-\u003eprev = prev\\n            prev-\u003enext = next   |\\n                                |                 // prev == B\\n                                |                 prev-\u003enext = next\\n\\nFix this by adding mutex when calling link_group() or unlink_group(),\\nbut parent configfs_subsystem is NULL when config_item is root.\\nSo I create a mutex configfs_subsystem_mutex.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: configfs: arregla una ejecuci\u00f3n en configfs_{,un}register_subsystem() Cuando configfs_register_subsystem() o configfs_unregister_subsystem() est\u00e1 ejecutando link_group() o unlink_group(), es posible que dos procesos agregar o eliminar la lista al mismo tiempo. Algunas intercalaciones desafortunadas de ellos pueden causar p\u00e1nico en el kernel. Uno de los casos es: A --\u0026gt; B --\u0026gt; C --\u0026gt; DA \u0026lt;-- B \u0026lt;-- C \u0026lt;-- D eliminar list_head *B | eliminar list_head *C --------------------------------|------------- ---------------------- configfs_unregister_subsystem | configfs_unregister_subsystem unlink_group | desvincular_grupo desvincular_obj | unlink_obj list_del_init | list_del_init __list_del_entry | __list_del_entry __list_del | __list_del // siguiente == C | siguiente-\u0026gt;anterior = anterior | | siguiente-\u0026gt;anterior = anterior anterior-\u0026gt;siguiente = siguiente | | // anterior == B | prev-\u0026gt;next = next Solucione esto agregando mutex al llamar a link_group() o unlink_group(), pero el configfs_subsystem principal es NULL cuando config_item es root. Entonces creo un mutex configfs_subsystem_mutex.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":1.0,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.16\",\"versionEndExcluding\":\"4.9.304\",\"matchCriteriaId\":\"21912390-FBA5-4A90-B649-77DB55849C77\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.10\",\"versionEndExcluding\":\"4.14.269\",\"matchCriteriaId\":\"F0F577D3-EFEA-42CF-80AA-905297529D7F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.15\",\"versionEndExcluding\":\"4.19.232\",\"matchCriteriaId\":\"EF11C6DC-8B9A-4A37-B1E6-33B68F5366ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.182\",\"matchCriteriaId\":\"EE74CED8-43BF-4060-9578-93A09735B4E2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.103\",\"matchCriteriaId\":\"1A95B717-3110-4D4F-B8FC-373919BB514D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.26\",\"matchCriteriaId\":\"9AB342AE-A62E-4947-A6EA-511453062B2B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.16.12\",\"matchCriteriaId\":\"C76BAB21-7F23-4AD8-A25F-CA7B262A2698\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3aadfd46858b1f64d4d6a0654b863e21aabff975\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/40805099af11f68c5ca7dbcfacf455da8f99f622\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/84ec758fb2daa236026506868c8796b0500c047d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a37024f7757c25550accdebf49e497ad6ae239fe\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a7ab53d3c27dfe83bb594456b9f38a37796ec39b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b7e2b91fcb5c78c414e33dc8d50642e307ca0c5a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d1654de19d42f513b6cfe955cc77e7f427e05a77\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e7a66dd2687758718eddd79b542a95cf3aa488cc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.