7.8

CVE-2022-49053

scsi: target: tcmu: Fix possible page UAF

In the Linux kernel, the following vulnerability has been resolved:

scsi: target: tcmu: Fix possible page UAF

tcmu_try_get_data_page() looks up pages under cmdr_lock, but it does not
take refcount properly and just returns page pointer. When
tcmu_try_get_data_page() returns, the returned page may have been freed by
tcmu_blocks_release().

We need to get_page() under cmdr_lock to avoid concurrent
tcmu_blocks_release().
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version < 4.14.276
Linux ≫ Linux Kernel Version >= 4.15 < 4.19.239
Linux ≫ Linux Kernel Version >= 4.20 < 5.4.190
Linux ≫ Linux Kernel Version >= 5.5 < 5.10.112
Linux ≫ Linux Kernel Version >= 5.11 < 5.15.35
Linux ≫ Linux Kernel Version >= 5.16 < 5.17.4
Linux ≫ Linux Kernel Version5.18 Updaterc1
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.27% 0.179
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
134c704f-9b21-4f2e-91b3-4a467353bcc0 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

https://git.kernel.org/stable/c/a6968f7a367f128d120447360734344d5a3d5336
Patch
https://git.kernel.org/stable/c/a9564d84ed9f6ee71017d062d0d2182154294a4b
Patch
https://git.kernel.org/stable/c/aec36b98a1bbaa84bfd8299a306e4c12314af626
Patch
https://git.kernel.org/stable/c/b7f3b5d70c834f49f7d87a2f2ed1c6284d9a0322
Patch
https://git.kernel.org/stable/c/d7c5d79e50be6e06b669141e3db1f977a0dd4e8e
Patch
https://git.kernel.org/stable/c/e3e0e067d5b34e4a68e3cc55f8eebc413f56f8ed
Patch
https://git.kernel.org/stable/c/fb7a5115422fbd6a4d505e8844f1ef5529f10489
Patch