{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/events/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3bbd868099287ff9027db59029b502fcfa2202a0",
              "status": "affected",
              "version": "9bb5d40cd93c9dd4be74834b1dcb1ba03629716b",
              "versionType": "git"
            },
            {
              "lessThan": "f836f9ac95df15f1e0af4beb0ec20021e8c91998",
              "status": "affected",
              "version": "9bb5d40cd93c9dd4be74834b1dcb1ba03629716b",
              "versionType": "git"
            },
            {
              "lessThan": "17f5417194136517ee9bbd6511249e5310e5617c",
              "status": "affected",
              "version": "9bb5d40cd93c9dd4be74834b1dcb1ba03629716b",
              "versionType": "git"
            },
            {
              "lessThan": "98c3c8fd0d4c560e0f8335b79c407bbf7fc9462c",
              "status": "affected",
              "version": "9bb5d40cd93c9dd4be74834b1dcb1ba03629716b",
              "versionType": "git"
            },
            {
              "lessThan": "43128b3eee337824158f34da6648163d2f2fb937",
              "status": "affected",
              "version": "9bb5d40cd93c9dd4be74834b1dcb1ba03629716b",
              "versionType": "git"
            },
            {
              "lessThan": "da3c256e2d0ebc87c7db0c605c9692b6f1722074",
              "status": "affected",
              "version": "9bb5d40cd93c9dd4be74834b1dcb1ba03629716b",
              "versionType": "git"
            },
            {
              "lessThan": "a9391ff7a7c5f113d6f2bf6621d49110950de49c",
              "status": "affected",
              "version": "9bb5d40cd93c9dd4be74834b1dcb1ba03629716b",
              "versionType": "git"
            },
            {
              "lessThan": "68e3c69803dada336893640110cb87221bb01dcf",
              "status": "affected",
              "version": "9bb5d40cd93c9dd4be74834b1dcb1ba03629716b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2487f0db30527032c4d56fc2d0b1a240fe89fef8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "703197b61d05f5edae54bad3256901c5a5c8794c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c52217e88ae0f3a4ae00562d86e338f8f85969b4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/events/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.10"
            },
            {
              "lessThan": "3.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.325",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.290",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.254",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.208",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.134",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.58",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.15",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.325",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.290",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.254",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.208",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.134",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.58",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.15",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.2.49",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.4.52",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.9.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/core: Fix data race between perf_event_set_output() and perf_mmap_close()\n\nYang Jihing reported a race between perf_event_set_output() and\nperf_mmap_close():\n\n\tCPU1\t\t\t\t\tCPU2\n\n\tperf_mmap_close(e2)\n\t  if (atomic_dec_and_test(\u0026e2-\u003erb-\u003emmap_count)) // 1 - \u003e 0\n\t    detach_rest = true\n\n\t\t\t\t\t\tioctl(e1, IOC_SET_OUTPUT, e2)\n\t\t\t\t\t\t  perf_event_set_output(e1, e2)\n\n\t  ...\n\t  list_for_each_entry_rcu(e, \u0026e2-\u003erb-\u003eevent_list, rb_entry)\n\t    ring_buffer_attach(e, NULL);\n\t    // e1 isn\u0027t yet added and\n\t    // therefore not detached\n\n\t\t\t\t\t\t    ring_buffer_attach(e1, e2-\u003erb)\n\t\t\t\t\t\t      list_add_rcu(\u0026e1-\u003erb_entry,\n\t\t\t\t\t\t\t\t   \u0026e2-\u003erb-\u003eevent_list)\n\nAfter this; e1 is attached to an unmapped rb and a subsequent\nperf_mmap() will loop forever more:\n\n\tagain:\n\t\tmutex_lock(\u0026e-\u003emmap_mutex);\n\t\tif (event-\u003erb) {\n\t\t\t...\n\t\t\tif (!atomic_inc_not_zero(\u0026e-\u003erb-\u003emmap_count)) {\n\t\t\t\t...\n\t\t\t\tmutex_unlock(\u0026e-\u003emmap_mutex);\n\t\t\t\tgoto again;\n\t\t\t}\n\t\t}\n\nThe loop in perf_mmap_close() holds e2-\u003emmap_mutex, while the attach\nin perf_event_set_output() holds e1-\u003emmap_mutex. As such there is no\nserialization to avoid this race.\n\nChange perf_event_set_output() to take both e1-\u003emmap_mutex and\ne2-\u003emmap_mutex to alleviate that problem. Additionally, have the loop\nin perf_mmap() detach the rb directly, this avoids having to wait for\nthe concurrent perf_mmap_close() to get around to doing it to make\nprogress."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T12:44:58.322Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3bbd868099287ff9027db59029b502fcfa2202a0"
        },
        {
          "url": "https://git.kernel.org/stable/c/f836f9ac95df15f1e0af4beb0ec20021e8c91998"
        },
        {
          "url": "https://git.kernel.org/stable/c/17f5417194136517ee9bbd6511249e5310e5617c"
        },
        {
          "url": "https://git.kernel.org/stable/c/98c3c8fd0d4c560e0f8335b79c407bbf7fc9462c"
        },
        {
          "url": "https://git.kernel.org/stable/c/43128b3eee337824158f34da6648163d2f2fb937"
        },
        {
          "url": "https://git.kernel.org/stable/c/da3c256e2d0ebc87c7db0c605c9692b6f1722074"
        },
        {
          "url": "https://git.kernel.org/stable/c/a9391ff7a7c5f113d6f2bf6621d49110950de49c"
        },
        {
          "url": "https://git.kernel.org/stable/c/68e3c69803dada336893640110cb87221bb01dcf"
        }
      ],
      "title": "perf/core: Fix data race between perf_event_set_output() and perf_mmap_close()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49607",
    "datePublished": "2025-02-26T02:23:31.823Z",
    "dateReserved": "2025-02-26T02:21:30.417Z",
    "dateUpdated": "2025-05-04T12:44:58.322Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49607\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-26T07:01:36.180\",\"lastModified\":\"2025-03-13T21:55:55.090\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nperf/core: Fix data race between perf_event_set_output() and perf_mmap_close()\\n\\nYang Jihing reported a race between perf_event_set_output() and\\nperf_mmap_close():\\n\\n\\tCPU1\\t\\t\\t\\t\\tCPU2\\n\\n\\tperf_mmap_close(e2)\\n\\t  if (atomic_dec_and_test(\u0026e2-\u003erb-\u003emmap_count)) // 1 - \u003e 0\\n\\t    detach_rest = true\\n\\n\\t\\t\\t\\t\\t\\tioctl(e1, IOC_SET_OUTPUT, e2)\\n\\t\\t\\t\\t\\t\\t  perf_event_set_output(e1, e2)\\n\\n\\t  ...\\n\\t  list_for_each_entry_rcu(e, \u0026e2-\u003erb-\u003eevent_list, rb_entry)\\n\\t    ring_buffer_attach(e, NULL);\\n\\t    // e1 isn\u0027t yet added and\\n\\t    // therefore not detached\\n\\n\\t\\t\\t\\t\\t\\t    ring_buffer_attach(e1, e2-\u003erb)\\n\\t\\t\\t\\t\\t\\t      list_add_rcu(\u0026e1-\u003erb_entry,\\n\\t\\t\\t\\t\\t\\t\\t\\t   \u0026e2-\u003erb-\u003eevent_list)\\n\\nAfter this; e1 is attached to an unmapped rb and a subsequent\\nperf_mmap() will loop forever more:\\n\\n\\tagain:\\n\\t\\tmutex_lock(\u0026e-\u003emmap_mutex);\\n\\t\\tif (event-\u003erb) {\\n\\t\\t\\t...\\n\\t\\t\\tif (!atomic_inc_not_zero(\u0026e-\u003erb-\u003emmap_count)) {\\n\\t\\t\\t\\t...\\n\\t\\t\\t\\tmutex_unlock(\u0026e-\u003emmap_mutex);\\n\\t\\t\\t\\tgoto again;\\n\\t\\t\\t}\\n\\t\\t}\\n\\nThe loop in perf_mmap_close() holds e2-\u003emmap_mutex, while the attach\\nin perf_event_set_output() holds e1-\u003emmap_mutex. As such there is no\\nserialization to avoid this race.\\n\\nChange perf_event_set_output() to take both e1-\u003emmap_mutex and\\ne2-\u003emmap_mutex to alleviate that problem. Additionally, have the loop\\nin perf_mmap() detach the rb directly, this avoids having to wait for\\nthe concurrent perf_mmap_close() to get around to doing it to make\\nprogress.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: perf_event_set_output() and perf_mmap_close() Yang Jihing reported a race between perf_event_set_output() and perf_mmap_close(): CPU1 CPU2 perf_mmap_close(e2) if (atomic_dec_and_test(\u0026amp;e2-\u0026gt;rb-\u0026gt;mmap_count)) // 1 - \u0026gt; 0 detach_rest = true ioctl(e1, IOC_SET_OUTPUT, e2) perf_event_set_output(e1, e2) ... list_for_each_entry_rcu(e, \u0026amp;e2-\u0026gt;rb-\u0026gt;event_list, rb_entry) ring_buffer_attach(e, NULL); // e1 isn\u0027t yet added and // therefore not detached ring_buffer_attach(e1, e2-\u0026gt;rb) list_add_rcu(\u0026amp;e1-\u0026gt;rb_entry, \u0026amp;e2-\u0026gt;rb-\u0026gt;event_list) After this; e1 is attached to an unmapped rb and a subsequent perf_mmap() will loop forever more: again: mutex_lock(\u0026amp;e-\u0026gt;mmap_mutex); if (event-\u0026gt;rb) { ... if (!atomic_inc_not_zero(\u0026amp;e-\u0026gt;rb-\u0026gt;mmap_count)) { ... mutex_unlock(\u0026amp;e-\u0026gt;mmap_mutex); goto again; } } The loop in perf_mmap_close() holds e2-\u0026gt;mmap_mutex, while the attach in perf_event_set_output() holds e1-\u0026gt;mmap_mutex. Como tal, no hay serializaci\u00f3n para evitar esta ejecuci\u00f3n. Cambie perf_event_set_output() para que acepte tanto e1-\u0026gt;mmap_mutex como e2-\u0026gt;mmap_mutex para aliviar ese problema. Adem\u00e1s, haga que el bucle en perf_mmap() desconecte el rb directamente, esto evita tener que esperar a que perf_mmap_close() concurrente lo haga para avanzar.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.2.49\",\"versionEndExcluding\":\"3.3\",\"matchCriteriaId\":\"2A0E6CA1-D820-4022-9A10-55C1BB83F02E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.4.52\",\"versionEndExcluding\":\"3.5\",\"matchCriteriaId\":\"B64F306D-C88E-4F4C-A677-1FD2635830E6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.9.8\",\"versionEndExcluding\":\"4.9.325\",\"matchCriteriaId\":\"2A44C19E-9011-43EB-8FE2-EC3270C84A19\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.10\",\"versionEndExcluding\":\"4.14.290\",\"matchCriteriaId\":\"1F023E37-5DAE-491D-9971-00FC089E8C7E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.15\",\"versionEndExcluding\":\"4.19.254\",\"matchCriteriaId\":\"56D38C39-4EB7-48A7-85D3-D4854AC7B3E8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.208\",\"matchCriteriaId\":\"58A5EC97-5FF0-4B0A-8074-2A5A57644D59\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.134\",\"matchCriteriaId\":\"4B697B47-6B36-47E0-95DC-054EC4633DEA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.58\",\"matchCriteriaId\":\"13CF20C8-4DA9-4A21-AD13-7A5C22E5FB05\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.18.15\",\"matchCriteriaId\":\"EAD6B571-194C-43A2-A4AB-F68F869D13BC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.19:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"A8C30C2D-F82D-4D37-AB48-D76ABFBD5377\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.19:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"BF8547FC-C849-4F1B-804B-A93AE2F04A92\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.19:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F3068028-F453-4A1C-B80F-3F5609ACEF60\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.19:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"2E9C0DB0-D349-489F-A3D6-B77214E93A8A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.19:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"1A0DE3B7-0FFB-45AA-9BD6-19870CA7C6FD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.19:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"00AE778B-BAEE-49EB-9F84-003B73D7862A\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/17f5417194136517ee9bbd6511249e5310e5617c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3bbd868099287ff9027db59029b502fcfa2202a0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/43128b3eee337824158f34da6648163d2f2fb937\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/68e3c69803dada336893640110cb87221bb01dcf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/98c3c8fd0d4c560e0f8335b79c407bbf7fc9462c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a9391ff7a7c5f113d6f2bf6621d49110950de49c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/da3c256e2d0ebc87c7db0c605c9692b6f1722074\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f836f9ac95df15f1e0af4beb0ec20021e8c91998\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}"
  }
}