CVE-2022-48791

Summary

In the Linux kernel, the following vulnerability has been resolved:

scsi: pm8001: Fix use-after-free for aborted TMF sas_task

Currently a use-after-free may occur if a TMF sas_task is aborted before we handle the IO completion in mpi_ssp_completion(). The abort occurs due to timeout.

When the timeout occurs, the SAS_TASK_STATE_ABORTED flag is set and the sas_task is freed in pm8001_exec_internal_tmf_task().

However, if the I/O completion occurs later, the I/O completion still thinks that the sas_task is available. Fix this by clearing the ccb->task if the TMF times out - the I/O completion handler does nothing if this pointer is cleared.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux968ee9176a4489ce6d5ee54ff88dadfbff9b95f4 < d872e7b5fe38f325f5206b6872746fa02c2b4819affected
LinuxLinuxd712d3fb484b7fa8d1d57e9ca6f134bb9d8c18b1 < 3c334cdfd94945b8edb94022a0371a8665b17366affected
LinuxLinuxd712d3fb484b7fa8d1d57e9ca6f134bb9d8c18b1 < 510b21442c3a2e3ecc071ba3e666b320e7acdd61affected
LinuxLinuxd712d3fb484b7fa8d1d57e9ca6f134bb9d8c18b1 < 61f162aa4381845acbdc7f2be4dfb694d027c018affected
LinuxLinuxfa3c19ceaa8b4b7c29d710c2c407df57d256a6c5affected
LinuxLinux5.10.61 < 5.10.102affected
LinuxLinux5.13.13 < 5.14affected
LinuxLinux5.14affected
LinuxLinux0 < 5.14unaffected
LinuxLinux5.10.102 <= 5.10.*unaffected
LinuxLinux5.15.25 <= 5.15.*unaffected
LinuxLinux5.16.11 <= 5.16.*unaffected
LinuxLinux5.17 <= *unaffected

Weaknesses

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References