7.8

CVE-2022-49076

RDMA/hfi1: Fix use-after-free bug for mm struct

In the Linux kernel, the following vulnerability has been resolved:

RDMA/hfi1: Fix use-after-free bug for mm struct

Under certain conditions, such as MPI_Abort, the hfi1 cleanup code may
represent the last reference held on the task mm.
hfi1_mmu_rb_unregister() then drops the last reference and the mm is freed
before the final use in hfi1_release_user_pages().  A new task may
allocate the mm structure while it is still being used, resulting in
problems. One manifestation is corruption of the mmap_sem counter leading
to a hang in down_write().  Another is corruption of an mm struct that is
in use by another task.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 5.9.12 < 5.10.111
Linux ≫ Linux Kernel Version >= 5.11 < 5.15.34
Linux ≫ Linux Kernel Version >= 5.16 < 5.16.20
Linux ≫ Linux Kernel Version >= 5.17 < 5.17.3
Linux ≫ Linux Kernel Version5.18 Updaterc1
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.24% 0.154
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
134c704f-9b21-4f2e-91b3-4a467353bcc0 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

https://git.kernel.org/stable/c/0b7186d657ee55e2cdefae498f07d5c1961e8023
Patch
https://git.kernel.org/stable/c/2bbac98d0930e8161b1957dc0ec99de39ade1b3c
Patch
https://git.kernel.org/stable/c/5a9a1b24ddb510715f8f621263938186579a965c
Patch
https://git.kernel.org/stable/c/5f54364ff6cfcd14cddf5441c4a490bb28dd69f7
Patch
https://git.kernel.org/stable/c/9ca11bd8222a612de0d2f54d050bfcf61ae2883f
Patch