CVE-2022-48792

Summary

In the Linux kernel, the following vulnerability has been resolved:

scsi: pm8001: Fix use-after-free for aborted SSP/STP sas_task

Currently a use-after-free may occur if a sas_task is aborted by the upper layer before we handle the I/O completion in mpi_ssp_completion() or mpi_sata_completion().

In this case, the following are the two steps in handling those I/O completions:

  • Call complete() to inform the upper layer handler of completion of the I/O.

  • Release driver resources associated with the sas_task in pm8001_ccb_task_free() call.

When complete() is called, the upper layer may free the sas_task. As such, we should not touch the associated sas_task afterwards, but we do so in the pm8001_ccb_task_free() call.

Fix by swapping the complete() and pm8001_ccb_task_free() calls ordering.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux869ddbdcae3b4fb83b99889abae31544c149b210 < fe9ac3eaa2e387a5742b380b73a5a6bc237bf184affected
LinuxLinux869ddbdcae3b4fb83b99889abae31544c149b210 < d9d93f32534a0a80a1c26bdb0746d90a7b19c2c2affected
LinuxLinux869ddbdcae3b4fb83b99889abae31544c149b210 < f61f9fccb2cb4bb275674a79d638704db6bc2171affected
LinuxLinux869ddbdcae3b4fb83b99889abae31544c149b210 < df7abcaa1246e2537ab4016077b5443bb3c09378affected
LinuxLinux4.15affected
LinuxLinux0 < 4.15unaffected
LinuxLinux5.10.102 <= 5.10.*unaffected
LinuxLinux5.15.25 <= 5.15.*unaffected
LinuxLinux5.16.11 <= 5.16.*unaffected
LinuxLinux5.17 <= *unaffected

Weaknesses

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References