Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-49284 State: PUBLISHED Published: 2025-02-26T01:56:24.622Z Last Updated: 2025-10-01T19:47:00.669Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: coresight: syscfg: Fix memleak on registration failure in cscfg_create_device device_register() calls device_initialize(), according to doc of device_initialize: Use put_device() to give up your reference instead of freeing * @dev directly once you have called this function. To prevent potential memleak, use put_device() for error handling. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/c61e2fc87f24cae4701f352fe9ecd4c5c
Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/c61e2fc87f24cae4701f352fe9ecd4c5c143106c - https://git.kernel.org/stable/c/a529af1f5a5c096f3e18f0d5a32cfcc3d82df1ec - https://git.kernel.org/stable/c/412225b32986d5b11c3c1ad9234c50a3f5c52c76 - https://git.kernel.org/stable/c/cfa5dbcdd7aece76f3415284569f2f384aff0253
CVE ID: CVE-2022-49285 State: PUBLISHED Published: 2025-02-26T01:56:25.096Z Last Updated: 2025-05-04T08:34:15.589Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: iio: accel: mma8452: use the correct logic to get mma8452_data The original logic to get mma8452_data is wrong, the *dev point to the device belong to iio_dev. we can't use this dev to find the correct i2c_client. The original logic happen to work because it finally use dev->driver_data to get iio_dev. Here use the API to_i2c_client() is wrong and make reader confuse. To correct the logic, it should be like this struct mma8452_data *data = iio_priv(dev_get_drvdata(dev)
e reader confuse. To correct the logic, it should be like this struct mma8452_data *data = iio_priv(dev_get_drvdata(dev)); But after commit 8b7651f25962 ("iio: iio_device_alloc(): Remove unnecessary self drvdata"), the upper logic also can't work. When try to show the avialable scale in userspace, will meet kernel dump, kernel handle NULL pointer dereference. So use dev_to_iio_dev() to correct the logic. Dual fixes tags as the second reflects when the bug was exposed, whilst the first reflects when the original bug was introduced. References: - https://git.kernel.org/stable/c/4c0bb583a4444cce224e8661090cbffc98e2fe07 - https://git.kernel.org/stable/c/d2d9ebdbff79d87d27652578e6d1638ad3b5f3bf -
/c/4c0bb583a4444cce224e8661090cbffc98e2fe07 - https://git.kernel.org/stable/c/d2d9ebdbff79d87d27652578e6d1638ad3b5f3bf - https://git.kernel.org/stable/c/c87b7b12f48db86ac9909894f4dc0107d7df6375
CVE ID: CVE-2022-49286 State: PUBLISHED Published: 2025-02-26T01:56:25.566Z Last Updated: 2025-05-04T08:34:16.652Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: tpm: use try_get_ops() in tpm-space.c As part of the series conversion to remove nested TPM operations: https://lore.kernel.org/all/20190205224723.19671-1-jarkko.sakkinen@linux.intel.com/ exposure of the chip->tpm_mutex was removed from much of the upper level code. In this conversion, tpm2_del_space() was missed. This didn't matter much because it's usually called closely after a converted operation, so there's only a very tiny race window where the chip can be remove
usually called closely after a converted operation, so there's only a very tiny race window where the chip can be removed before the space flushing is done which causes a NULL deref on the mutex. However, there are reports of this window being hit in practice, so fix this by converting tpm2_del_space() to use tpm_try_get_ops(), which performs all the teardown checks before acquring the mutex. References: - https://git.kernel.org/stable/c/5b1d2561a03e534064b51c50c774657833d3d2cf - https://git.kernel.org/stable/c/95193d12f10a8a088843b25e0f5fe1d83ec6b079 - https://git.kernel.org/stable/c/476ddd23f818fb94cf86fb5617f3bb9a7c92113d - https://git.kernel.org/stable/c/eda1662cce964c8a65bb86321f8d9cfa6
rg/stable/c/476ddd23f818fb94cf86fb5617f3bb9a7c92113d - https://git.kernel.org/stable/c/eda1662cce964c8a65bb86321f8d9cfa6e9ceaab - https://git.kernel.org/stable/c/ba84f9a48366dcc3cdef978599433efe101dd5bd - https://git.kernel.org/stable/c/fb5abce6b2bb5cb3d628aaa63fa821da8c4600f9
CVE ID: CVE-2022-49287 State: PUBLISHED Published: 2025-02-26T01:56:26.059Z Last Updated: 2025-05-04T08:34:17.839Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: tpm: fix reference counting for struct tpm_chip The following sequence of operations results in a refcount warning: 1. Open device /dev/tpmrm. 2. Remove module tpm_tis_spi. 3. Write a TPM command to the file descriptor opened at step 1. ------------[ cut here ]------------ WARNING: CPU: 3 PID: 1161 at lib/refcount.c:25 kobject_get+0xa0/0xa4 refcount_t: addition on 0; use-after-free. Modules linked in: tpm_tis_spi tpm_tis_core tpm mdio_bcm_unimac brcmfmac sha256_generic
: addition on 0; use-after-free. Modules linked in: tpm_tis_spi tpm_tis_core tpm mdio_bcm_unimac brcmfmac sha256_generic libsha256 sha256_arm hci_uart btbcm bluetooth cfg80211 vc4 brcmutil ecdh_generic ecc snd_soc_core crc32_arm_ce libaes raspberrypi_hwmon ac97_bus snd_pcm_dmaengine bcm2711_thermal snd_pcm snd_timer genet snd phy_generic soundcore [last unloaded: spi_bcm2835] CPU: 3 PID: 1161 Comm: hold_open Not tainted 5.10.0ls-main-dirty #2 Hardware name: BCM2711 [<c0410c3c>] (unwind_backtrace) from [<c040b580>] (show_stack+0x10/0x14) [<c040b580>] (show_stack) from [<c1092174>] (dump_stack+0xc4/0xd8) [<c1092174>] (dump_stack) from [<c0445a30>] (__warn+0x104/0x108) [<c0445a30>] (__warn) fro
2174>] (dump_stack+0xc4/0xd8) [<c1092174>] (dump_stack) from [<c0445a30>] (__warn+0x104/0x108) [<c0445a30>] (__warn) from [<c0445aa8>] (warn_slowpath_fmt+0x74/0xb8) [<c0445aa8>] (warn_slowpath_fmt) from [<c08435d0>] (kobject_get+0xa0/0xa4) [<c08435d0>] (kobject_get) from [<bf0a715c>] (tpm_try_get_ops+0x14/0x54 [tpm]) [<bf0a715c>] (tpm_try_get_ops [tpm]) from [<bf0a7d6c>] (tpm_common_write+0x38/0x60 [tpm]) [<bf0a7d6c>] (tpm_common_write [tpm]) from [<c05a7ac0>] (vfs_write+0xc4/0x3c0) [<c05a7ac0>] (vfs_write) from [<c05a7ee4>] (ksys_write+0x58/0xcc) [<c05a7ee4>] (ksys_write) from [<c04001a0>] (ret_fast_syscall+0x0/0x4c) Exception stack(0xc226bfa8 to 0xc226bff0) bfa0: 00000000 000105b4 00000003
from [<c04001a0>] (ret_fast_syscall+0x0/0x4c) Exception stack(0xc226bfa8 to 0xc226bff0) bfa0: 00000000 000105b4 00000003 beafe664 00000014 00000000 bfc0: 00000000 000105b4 000103f8 00000004 00000000 00000000 b6f9c000 beafe684 bfe0: 0000006c beafe648 0001056c b6eb6944 ---[ end trace d4b8409def9b8b1f ]--- The reason for this warning is the attempt to get the chip->dev reference in tpm_common_write() although the reference counter is already zero. Since commit 8979b02aaf1d ("tpm: Fix reference count to main device") the extra reference used to prevent a premature zero counter is never taken, because the required TPM_CHIP_FLAG_TPM2 flag is never set. Fix this by moving the TPM 2 character device
is never taken, because the required TPM_CHIP_FLAG_TPM2 flag is never set. Fix this by moving the TPM 2 character device handling from tpm_chip_alloc() to tpm_add_char_device() which is called at a later point in time when the flag has been set in case of TPM2. Commit fdc915f7f719 ("tpm: expose spaces via a device link /dev/tpmrm<n>") already introduced function tpm_devs_release() to release the extra reference but did not implement the required put on chip->devs that results in the call of this function. Fix this by putting chip->devs in tpm_chip_unregister(). Finally move the new implementation for the TPM 2 handling into a new function to avoid multiple checks for the TPM_CHIP_FLAG_TPM2 f
the new implementation for the TPM 2 handling into a new function to avoid multiple checks for the TPM_CHIP_FLAG_TPM2 flag in the good case and error cases. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/473a66f99cb8173c14138c5a5c69bfad04e8f9ac - https://git.kernel.org/stable/c/cb64bd038beacb4331fe464a36c8b5481e8f51e2 - https://git.kernel.org/stable/c/a27ed2f3695baf15f9b34d2d7a1f9fc105539a81 - https://git.kernel.org/stable/c/290e05f346d1829e849662c97e42d5ad984f5258 - https://git.kernel.org/stable/c/662893b4f6bd466ff9e1cd454c44c26d32d554fe - https://git.kernel.org/stable/c/2f928c0d5c02dbab49e8c19d98725c822f6fc409 - https://git.kernel.org/stab
c44c26d32d554fe - https://git.kernel.org/stable/c/2f928c0d5c02dbab49e8c19d98725c822f6fc409 - https://git.kernel.org/stable/c/6e7baf84149fb43950631415de231b3a41915aa3 - https://git.kernel.org/stable/c/7e0438f83dc769465ee663bb5dcf8cc154940712
CVE ID: CVE-2022-49288 State: PUBLISHED Published: 2025-02-26T01:56:26.550Z Last Updated: 2025-05-04T08:34:18.875Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Fix races among concurrent prealloc proc writes We have no protection against concurrent PCM buffer preallocation changes via proc files, and it may potentially lead to UAF or some weird problem. This patch applies the PCM open_mutex to the proc write operation for avoiding the racy proc writes and the PCM stream open (and further operations). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/e7786c445bb67a9a6e6
s). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/e7786c445bb67a9a6e64f66ebd6b7215b153ff7d - https://git.kernel.org/stable/c/e14dca613e0a6ddc2bf6e360f16936a9f865205b - https://git.kernel.org/stable/c/37b12c16beb6f6c1c3c678c1aacbc46525c250f7 - https://git.kernel.org/stable/c/b560d670c87d7d40b3cf6949246fa4c7aa65a00a - https://git.kernel.org/stable/c/51fce708ab8986a9879ee5da946a2cc120f1036d - https://git.kernel.org/stable/c/a21d2f323b5a978dedf9ff1d50f101f85e39b3f2 - https://git.kernel.org/stable/c/5ed8f8e3c4e59d0396b9ccf2e639711e24295bb6 - https://git.kernel.org/stable/c/69534c48ba8ce552ce383b3dfdb271ffe51820c3
CVE ID: CVE-2022-49289 State: PUBLISHED Published: 2025-02-26T01:56:27.026Z Last Updated: 2025-05-04T08:34:19.985Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: uaccess: fix integer overflow on access_ok() Three architectures check the end of a user access against the address limit without taking a possible overflow into account. Passing a negative length or another overflow in here returns success when it should not. Use the most common correct implementation here, which optimizes for a constant 'size' argument, and turns the common case into a single comparison. References: - https://git.kernel.org/stable/c/e65d28d4e9bf90a35
ent, and turns the common case into a single comparison. References: - https://git.kernel.org/stable/c/e65d28d4e9bf90a35ba79c06661a572a38391dec - https://git.kernel.org/stable/c/99801e2f457824955da4aadaa035913a6dede03a - https://git.kernel.org/stable/c/a1ad747fc1a0e06d1bf26b996ee8a56b5c8d02d8 - https://git.kernel.org/stable/c/222ca305c9fd39e5ed8104da25c09b2b79a516a8
CVE ID: CVE-2022-49290 State: PUBLISHED Published: 2025-02-26T01:56:27.500Z Last Updated: 2025-10-01T19:47:00.523Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mac80211: fix potential double free on mesh join While commit 6a01afcf8468 ("mac80211: mesh: Free ie data when leaving mesh") fixed a memory leak on mesh leave / teardown it introduced a potential memory corruption caused by a double free when rejoining the mesh: ieee80211_leave_mesh() -> kfree(sdata->u.mesh.ie); ... ieee80211_join_mesh() -> copy_mesh_setup() -> old_ie = ifmsh->ie; -> kfree(old_ie); This double free / kernel panics can be reproduced by using wpa_suppli
_setup() -> old_ie = ifmsh->ie; -> kfree(old_ie); This double free / kernel panics can be reproduced by using wpa_supplicant with an encrypted mesh (if set up without encryption via "iw" then ifmsh->ie is always NULL, which avoids this issue). And then calling: $ iw dev mesh0 mesh leave $ iw dev mesh0 mesh join my-mesh Note that typically these commands are not used / working when using wpa_supplicant. And it seems that wpa_supplicant or wpa_cli are going through a NETDEV_DOWN/NETDEV_UP cycle between a mesh leave and mesh join where the NETDEV_UP resets the mesh.ie to NULL via a memcpy of default_mesh_setup in cfg80211_netdev_notifier_call, which then avoids the memory corruption, too. The i
via a memcpy of default_mesh_setup in cfg80211_netdev_notifier_call, which then avoids the memory corruption, too. The issue was first observed in an application which was not using wpa_supplicant but "Senf" instead, which implements its own calls to nl80211. Fixing the issue by removing the kfree()'ing of the mesh IE in the mesh join function and leaving it solely up to the mesh leave to free the mesh IE. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/615716af8644813355e014314a0bc1e961250f5a - https://git.kernel.org/stable/c/c1d9c3628ef0a0ca197595d0f9e01cd3b5dda186 - https://git.kernel.org/stable/c/273ebddc5fda2967492cb0b6cdd7d81cfb821b76 -
c/c1d9c3628ef0a0ca197595d0f9e01cd3b5dda186 - https://git.kernel.org/stable/c/273ebddc5fda2967492cb0b6cdd7d81cfb821b76 - https://git.kernel.org/stable/c/3bbd0000d012f92aec423b224784fbf0f7bf40f8 - https://git.kernel.org/stable/c/5d3ff9542a40ce034416bca03864709540a36016 - https://git.kernel.org/stable/c/12e407a8ef17623823fd0c066fbd7f103953d28d - https://git.kernel.org/stable/c/582d8c60c0c053684f7138875e8150d5749ffc17 - https://git.kernel.org/stable/c/46bb87d40683337757a2f902fcd4244b32bb4e86 - https://git.kernel.org/stable/c/4a2d4496e15ea5bb5c8e83b94ca8ca7fb045e7d3
CVE ID: CVE-2022-49291 State: PUBLISHED Published: 2025-02-26T01:56:27.986Z Last Updated: 2025-05-04T08:34:22.432Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Fix races among concurrent hw_params and hw_free calls Currently we have neither proper check nor protection against the concurrent calls of PCM hw_params and hw_free ioctls, which may result in a UAF. Since the existing PCM stream lock can't be used for protecting the whole ioctl operations, we need a new mutex to protect those racy calls. This patch introduced a new mutex, runtime->buffer_mutex, and applies it to both hw_params and hw_free ioctl code paths
This patch introduced a new mutex, runtime->buffer_mutex, and applies it to both hw_params and hw_free ioctl code paths. Along with it, the both functions are slightly modified (the mmap_count check is moved into the state-check block) for code simplicity. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/a42aa926843acca96c0dfbde2e835b8137f2f092 - https://git.kernel.org/stable/c/9cb6c40a6ebe4a0cfc9d6a181958211682cffea9 - https://git.kernel.org/stable/c/fbeb492694ce0441053de57699e1e2b7bc148a69 - https://git.kernel.org/stable/c/0f6947f5f5208f6ebd4d76a82a4757e2839a23f8 - https://git.kernel.org/stable/c/33061d0fba51d2bf70a2ef9645f703c33fe8e438 - ht
0f6947f5f5208f6ebd4d76a82a4757e2839a23f8 - https://git.kernel.org/stable/c/33061d0fba51d2bf70a2ef9645f703c33fe8e438 - https://git.kernel.org/stable/c/0090c13cbbdffd7da079ac56f80373a9a1be0bf8 - https://git.kernel.org/stable/c/1bbf82d9f961414d6c76a08f7f843ea068e0ab7b - https://git.kernel.org/stable/c/92ee3c60ec9fe64404dc035e7c41277d74aa26cb
CVE ID: CVE-2022-49292 State: PUBLISHED Published: 2025-02-26T01:56:28.552Z Last Updated: 2025-05-04T08:34:23.499Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ALSA: oss: Fix PCM OSS buffer allocation overflow We've got syzbot reports hitting INT_MAX overflow at vmalloc() allocation that is called from snd_pcm_plug_alloc(). Although we apply the restrictions to input parameters, it's based only on the hw_params of the underlying PCM device. Since the PCM OSS layer allocates a temporary buffer for the data conversion, the size may become unexpectedly large when more channels or higher rates is given; in the reported case, it w
nversion, the size may become unexpectedly large when more channels or higher rates is given; in the reported case, it went over INT_MAX, hence it hits WARN_ON(). This patch is an attempt to avoid such an overflow and an allocation for too large buffers. First off, it adds the limit of 1MB as the upper bound for period bytes. This must be large enough for all use cases, and we really don't want to handle a larger temporary buffer than this size. The size check is performed at two places, where the original period bytes is calculated and where the plugin buffer size is calculated. In addition, the driver uses array_size() and array3_size() for multiplications to catch overflows for the conver
lated. In addition, the driver uses array_size() and array3_size() for multiplications to catch overflows for the converted period size and buffer bytes. References: - https://git.kernel.org/stable/c/a63af1baf0a5e11827db60e3127f87e437cab6e5 - https://git.kernel.org/stable/c/0c4190b41a69990666b4000999e27f8f1b2a426b - https://git.kernel.org/stable/c/5ce74ff7059341d8b2f4d01c3383491df63d1898 - https://git.kernel.org/stable/c/7a40cbf3579a8e14849ba7ce46309c1992658d2b - https://git.kernel.org/stable/c/fb08bf99195a87c798bc8ae1357337a981faeade - https://git.kernel.org/stable/c/e74a069c6a7bb505f3ade141dddf85f4b0b5145a - https://git.kernel.org/stable/c/efb6402c3c4a7c26d97c92d70186424097b6e366
CVE ID: CVE-2022-49293 State: PUBLISHED Published: 2025-02-26T01:56:29.033Z Last Updated: 2025-05-04T08:34:24.805Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: initialize registers in nft_do_chain() Initialize registers to avoid stack leak into userspace. References: - https://git.kernel.org/stable/c/4d28522acd1c4415c85f6b33463713a268f68965 - https://git.kernel.org/stable/c/a3cc32863b175168283cb0a5fde08de6a1e27df9 - https://git.kernel.org/stable/c/88791b79a1eb2ba94e95d039243e28433583a67b - https://git.kernel.org/stable/c/06f0ff82c70241a766a811ae1acf07d6e2734dcb - https://git.kernel.org/stable/c/2c74374c2
b - https://git.kernel.org/stable/c/06f0ff82c70241a766a811ae1acf07d6e2734dcb - https://git.kernel.org/stable/c/2c74374c2e88c7b7992bf808d9f9391f7452f9d9 - https://git.kernel.org/stable/c/fafb904156fbb8f1dd34970cd5223e00b47c33be - https://git.kernel.org/stable/c/64f24c76dd0ce53d0fa3a0bfb9aeea507c769485 - https://git.kernel.org/stable/c/dd03640529204ef4b8189fbdea08217d8d98271f - https://git.kernel.org/stable/c/4c905f6740a365464e91467aa50916555b28213d
CVE ID: CVE-2022-49294 State: PUBLISHED Published: 2025-02-26T02:01:25.159Z Last Updated: 2025-10-01T19:47:00.252Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check if modulo is 0 before dividing. [How & Why] If a value of 0 is read, then this will cause a divide-by-0 panic. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/10ef82d6e0af5536ec64770c07f6bbabfdd6977c - https://git.kernel.org/stable/c/96725758eff7b3805e4e94d1443a100757412720 - https://git.kernel.org/stable/c/07efce8269a038c37814eb656b4de14aa3015fc6 - https://git.kernel.org/stable/c/49947b906a6bd9668
s://git.kernel.org/stable/c/07efce8269a038c37814eb656b4de14aa3015fc6 - https://git.kernel.org/stable/c/49947b906a6bd9668eaf4f9cf691973c25c26955
CVE ID: CVE-2022-49295 State: PUBLISHED Published: 2025-02-26T02:01:25.659Z Last Updated: 2025-10-29T10:49:58.050Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nbd: call genl_unregister_family() first in nbd_cleanup() Otherwise there may be race between module removal and the handling of netlink command, which can lead to the oops as shown below: BUG: kernel NULL pointer dereference, address: 0000000000000098 Oops: 0002 [#1] SMP PTI CPU: 1 PID: 31299 Comm: nbd-client Tainted: G E 5.14.0-rc4 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) RIP: 0010:down_write+0x1a/0x50 Call Trace: start_creating+0x89/0x130 debugfs_create
MU Standard PC (i440FX + PIIX, 1996) RIP: 0010:down_write+0x1a/0x50 Call Trace: start_creating+0x89/0x130 debugfs_create_dir+0x1b/0x130 nbd_start_device+0x13d/0x390 [nbd] nbd_genl_connect+0x42f/0x748 [nbd] genl_family_rcv_msg_doit.isra.0+0xec/0x150 genl_rcv_msg+0xe5/0x1e0 netlink_rcv_skb+0x55/0x100 genl_rcv+0x29/0x40 netlink_unicast+0x1a8/0x250 netlink_sendmsg+0x21b/0x430 ____sys_sendmsg+0x2a4/0x2d0 ___sys_sendmsg+0x81/0xc0 __sys_sendmsg+0x62/0xb0 __x64_sys_sendmsg+0x1f/0x30 do_syscall_64+0x3b/0xc0 entry_SYSCALL_64_after_hwframe+0x44/0xae Modules linked in: nbd(E-) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/8a1435c862ea09b06be7acda325128d
al Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/8a1435c862ea09b06be7acda325128dc08458e25 - https://git.kernel.org/stable/c/013a79f1b5c89290e2e97f1ebf14b14e0cf5fe5c - https://git.kernel.org/stable/c/1be608e1ee1f222464b2856bda9b85ab5184a33e - https://git.kernel.org/stable/c/c0868f6e728c3c28bef0e8bee89d2daf86a8bbca - https://git.kernel.org/stable/c/cbeafa7a79d08ecdb55f8f1d41a11323d0f709db - https://git.kernel.org/stable/c/6f505bbb8063fd3a238a4239d2d8c165e5279f6f - https://git.kernel.org/stable/c/3d5da1ffba3388c2ae2e6c598855a4d887d3bf79 - https://git.kernel.org/stable/c/06c4da89c24e7023ea448cadf8e9daf06a0aae6e
CVE ID: CVE-2022-49296 State: PUBLISHED Published: 2025-02-26T02:01:26.131Z Last Updated: 2025-10-01T19:46:59.734Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ceph: fix possible deadlock when holding Fwb to get inline_data 1, mount with wsync. 2, create a file with O_RDWR, and the request was sent to mds.0: ceph_atomic_open()--> ceph_mdsc_do_request(openc) finish_open(file, dentry, ceph_open)--> ceph_open()--> ceph_init_file()--> ceph_init_file_info()--> ceph_uninline_data()--> { ... if (inline_version == 1 || /* initial version, no data */ inline_version == CEPH_INLINE_NONE) goto out_unlock; ... } The inline_version will be
|| /* initial version, no data */ inline_version == CEPH_INLINE_NONE) goto out_unlock; ... } The inline_version will be 1, which is the initial version for the new create file. And here the ci->i_inline_version will keep with 1, it's buggy. 3, buffer write to the file immediately: ceph_write_iter()--> ceph_get_caps(file, need=Fw, want=Fb, ...); generic_perform_write()--> a_ops->write_begin()--> ceph_write_begin()--> netfs_write_begin()--> netfs_begin_read()--> netfs_rreq_submit_slice()--> netfs_read_from_server()--> rreq->netfs_ops->issue_read()--> ceph_netfs_issue_read()--> { ... if (ci->i_inline_version != CEPH_INLINE_NONE && ceph_netfs_issue_op_inline(subreq)) return; ... } ceph_put_cap_
-> { ... if (ci->i_inline_version != CEPH_INLINE_NONE && ceph_netfs_issue_op_inline(subreq)) return; ... } ceph_put_cap_refs(ci, Fwb); The ceph_netfs_issue_op_inline() will send a getattr(Fsr) request to mds.1. 4, then the mds.1 will request the rd lock for CInode::filelock from the auth mds.0, the mds.0 will do the CInode::filelock state transation from excl --> sync, but it need to revoke the Fxwb caps back from the clients. While the kernel client has aleady held the Fwb caps and waiting for the getattr(Fsr). It's deadlock! URL: https://tracker.ceph.com/issues/55377 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/292b7a7275ce535a1abfa4dd0b2
tional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/292b7a7275ce535a1abfa4dd0b2e586162aaae1e - https://git.kernel.org/stable/c/825978fd6a0defc3c29d8a38b6cea76a0938d21e