CVE-2022-48666 (GCVE-0-2022-48666)
Vulnerability from cvelistv5
Published
2024-04-28 13:01
Modified
2026-08-05 08:51
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix a use-after-free There are two .exit_cmd_priv implementations. Both implementations use resources associated with the SCSI host. Make sure that these resources are still available when .exit_cmd_priv is called by waiting inside scsi_remove_host() until the tag set has been freed. This commit fixes the following use-after-free: ================================================================== BUG: KASAN: use-after-free in srp_exit_cmd_priv+0x27/0xd0 [ib_srp] Read of size 8 at addr ffff888100337000 by task multipathd/16727 Call Trace: <TASK> dump_stack_lvl+0x34/0x44 print_report.cold+0x5e/0x5db kasan_report+0xab/0x120 srp_exit_cmd_priv+0x27/0xd0 [ib_srp] scsi_mq_exit_request+0x4d/0x70 blk_mq_free_rqs+0x143/0x410 __blk_mq_free_map_and_rqs+0x6e/0x100 blk_mq_free_tag_set+0x2b/0x160 scsi_host_dev_release+0xf3/0x1a0 device_release+0x54/0xe0 kobject_put+0xa5/0x120 device_release+0x54/0xe0 kobject_put+0xa5/0x120 scsi_device_dev_release_usercontext+0x4c1/0x4e0 execute_in_process_context+0x23/0x90 device_release+0x54/0xe0 kobject_put+0xa5/0x120 scsi_disk_release+0x3f/0x50 device_release+0x54/0xe0 kobject_put+0xa5/0x120 disk_release+0x17f/0x1b0 device_release+0x54/0xe0 kobject_put+0xa5/0x120 dm_put_table_device+0xa3/0x160 [dm_mod] dm_put_device+0xd0/0x140 [dm_mod] free_priority_group+0xd8/0x110 [dm_multipath] free_multipath+0x94/0xe0 [dm_multipath] dm_table_destroy+0xa2/0x1e0 [dm_mod] __dm_destroy+0x196/0x350 [dm_mod] dev_remove+0x10c/0x160 [dm_mod] ctl_ioctl+0x2c2/0x590 [dm_mod] dm_ctl_ioctl+0x5/0x10 [dm_mod] __x64_sys_ioctl+0xb4/0xf0 dm_ctl_ioctl+0x5/0x10 [dm_mod] __x64_sys_ioctl+0xb4/0xf0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x46/0xb0
References
Impacted products
Vendor Product Version
Linux Linux Version: 65ca846a53149a1a72cd8d02e7b2e73dd545b834
Version: 65ca846a53149a1a72cd8d02e7b2e73dd545b834
Version: 65ca846a53149a1a72cd8d02e7b2e73dd545b834
Version: 65ca846a53149a1a72cd8d02e7b2e73dd545b834
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:5.7:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "status": "affected",
                "version": "5.7"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "2e7eb4c1e8af",
                "status": "affected",
                "version": "65ca846a5314",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.4,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-48666",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-29T13:16:40.985574Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:16:47.878Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T15:17:55.718Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5ce8fad941233e81f2afb5b52a3fcddd3ba8732f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f818708eeeae793e12dc39f8984ed7732048a7d9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2e7eb4c1e8af8385de22775bd0be552f59b28c9a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8fe4ce5836e932f5766317cb651c1ff2a4cd0506"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/hosts.c",
            "drivers/scsi/scsi_lib.c",
            "drivers/scsi/scsi_priv.h",
            "drivers/scsi/scsi_scan.c",
            "drivers/scsi/scsi_sysfs.c",
            "include/scsi/scsi_host.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5ce8fad941233e81f2afb5b52a3fcddd3ba8732f",
              "status": "affected",
              "version": "65ca846a53149a1a72cd8d02e7b2e73dd545b834",
              "versionType": "git"
            },
            {
              "lessThan": "f818708eeeae793e12dc39f8984ed7732048a7d9",
              "status": "affected",
              "version": "65ca846a53149a1a72cd8d02e7b2e73dd545b834",
              "versionType": "git"
            },
            {
              "lessThan": "2e7eb4c1e8af8385de22775bd0be552f59b28c9a",
              "status": "affected",
              "version": "65ca846a53149a1a72cd8d02e7b2e73dd545b834",
              "versionType": "git"
            },
            {
              "lessThan": "8fe4ce5836e932f5766317cb651c1ff2a4cd0506",
              "status": "affected",
              "version": "65ca846a53149a1a72cd8d02e7b2e73dd545b834",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/hosts.c",
            "drivers/scsi/scsi_lib.c",
            "drivers/scsi/scsi_priv.h",
            "drivers/scsi/scsi_scan.c",
            "drivers/scsi/scsi_sysfs.c",
            "include/scsi/scsi_host.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "lessThan": "5.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.223",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.164",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.19.*",
              "status": "unaffected",
              "version": "5.19.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.223",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.164",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19.12",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: core: Fix a use-after-free\n\nThere are two .exit_cmd_priv implementations. Both implementations use\nresources associated with the SCSI host. Make sure that these resources are\nstill available when .exit_cmd_priv is called by waiting inside\nscsi_remove_host() until the tag set has been freed.\n\nThis commit fixes the following use-after-free:\n\n==================================================================\nBUG: KASAN: use-after-free in srp_exit_cmd_priv+0x27/0xd0 [ib_srp]\nRead of size 8 at addr ffff888100337000 by task multipathd/16727\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x34/0x44\n print_report.cold+0x5e/0x5db\n kasan_report+0xab/0x120\n srp_exit_cmd_priv+0x27/0xd0 [ib_srp]\n scsi_mq_exit_request+0x4d/0x70\n blk_mq_free_rqs+0x143/0x410\n __blk_mq_free_map_and_rqs+0x6e/0x100\n blk_mq_free_tag_set+0x2b/0x160\n scsi_host_dev_release+0xf3/0x1a0\n device_release+0x54/0xe0\n kobject_put+0xa5/0x120\n device_release+0x54/0xe0\n kobject_put+0xa5/0x120\n scsi_device_dev_release_usercontext+0x4c1/0x4e0\n execute_in_process_context+0x23/0x90\n device_release+0x54/0xe0\n kobject_put+0xa5/0x120\n scsi_disk_release+0x3f/0x50\n device_release+0x54/0xe0\n kobject_put+0xa5/0x120\n disk_release+0x17f/0x1b0\n device_release+0x54/0xe0\n kobject_put+0xa5/0x120\n dm_put_table_device+0xa3/0x160 [dm_mod]\n dm_put_device+0xd0/0x140 [dm_mod]\n free_priority_group+0xd8/0x110 [dm_multipath]\n free_multipath+0x94/0xe0 [dm_multipath]\n dm_table_destroy+0xa2/0x1e0 [dm_mod]\n __dm_destroy+0x196/0x350 [dm_mod]\n dev_remove+0x10c/0x160 [dm_mod]\n ctl_ioctl+0x2c2/0x590 [dm_mod]\n dm_ctl_ioctl+0x5/0x10 [dm_mod]\n __x64_sys_ioctl+0xb4/0xf0\n dm_ctl_ioctl+0x5/0x10 [dm_mod]\n __x64_sys_ioctl+0xb4/0xf0\n do_syscall_64+0x3b/0x90\n entry_SYSCALL_64_after_hwframe+0x46/0xb0"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - ib_srp is an RDMA/SRP initiator (IB or RoCE); a remote fabric peer can force transport errors that expire dev_loss_tmo, call rport_delete\u2192scsi_remove_host, and reach the UAF during later tag-set teardown\u2014analogous to prior NVMe-oF fabric-teardown Network scores.\nAC:L - Once an SRP target is in use under multipath (the normal HA deployment shown in the KASAN stack), the peer can deterministically drop the link and wait for kernel timers plus multipathd cleanup; this is a lifetime bug, not a race the attacker cannot control.\nPR:N - Teardown is driven by unauthenticated remote transport/reconnect-failure events on an already-configured SRP session; the peer needs no local account or capability on the initiator (multipathd/sysfs CAP_SYS_ADMIN runs as victim-side reaction).\nUI:N - After the SRP path is established, disconnect handling, dev_loss_tmo, and multipathd device removal proceed from kernel workqueues/daemons with no additional victim user action at exploit time.\nS:U - The UAF corrupts in-kernel SCSI/SRP/blk-mq objects within the same host kernel authority and does not cross a VM, IOMMU, or other security-authority boundary.\nC:H - This is a confirmed KASAN use-after-free in srp_exit_cmd_priv during tag-set free; per kernel guidance a UAF yields an attacker-controllable read primitive via reclaim of the freed object.\nI:H - Use-after-free of host-associated command-private state during blk_mq_free_tag_set enables heap spray and arbitrary write/control-flow hijack primitives, so integrity impact is High.\nA:H - The UAF produces a kernel oops/KASAN fault in the exit_cmd_priv path (as in the reported multipathd stack), which is full availability loss even without further exploitation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:51:41.922Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5ce8fad941233e81f2afb5b52a3fcddd3ba8732f"
        },
        {
          "url": "https://git.kernel.org/stable/c/f818708eeeae793e12dc39f8984ed7732048a7d9"
        },
        {
          "url": "https://git.kernel.org/stable/c/2e7eb4c1e8af8385de22775bd0be552f59b28c9a"
        },
        {
          "url": "https://git.kernel.org/stable/c/8fe4ce5836e932f5766317cb651c1ff2a4cd0506"
        }
      ],
      "title": "scsi: core: Fix a use-after-free",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48666",
    "datePublished": "2024-04-28T13:01:50.526Z",
    "dateReserved": "2024-02-25T13:44:28.320Z",
    "dateUpdated": "2026-08-05T08:51:41.922Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/5ce8fad941233e81f2afb5b52a3fcddd3ba8732f\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/f818708eeeae793e12dc39f8984ed7732048a7d9\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/2e7eb4c1e8af8385de22775bd0be552f59b28c9a\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/8fe4ce5836e932f5766317cb651c1ff2a4cd0506\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T15:17:55.718Z\"}}, {\"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.4, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-48666\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-04-29T13:16:40.985574Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:5.7:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.7\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"affected\", \"version\": \"65ca846a5314\", \"lessThan\": \"2e7eb4c1e8af\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-04-29T13:24:44.586Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"scsi: core: Fix a use-after-free\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:N - ib_srp is an RDMA/SRP initiator (IB or RoCE); a remote fabric peer can force transport errors that expire dev_loss_tmo, call rport_delete\\u2192scsi_remove_host, and reach the UAF during later tag-set teardown\\u2014analogous to prior NVMe-oF fabric-teardown Network scores.\\nAC:L - Once an SRP target is in use under multipath (the normal HA deployment shown in the KASAN stack), the peer can deterministically drop the link and wait for kernel timers plus multipathd cleanup; this is a lifetime bug, not a race the attacker cannot control.\\nPR:N - Teardown is driven by unauthenticated remote transport/reconnect-failure events on an already-configured SRP session; the peer needs no local account or capability on the initiator (multipathd/sysfs CAP_SYS_ADMIN runs as victim-side reaction).\\nUI:N - After the SRP path is established, disconnect handling, dev_loss_tmo, and multipathd device removal proceed from kernel workqueues/daemons with no additional victim user action at exploit time.\\nS:U - The UAF corrupts in-kernel SCSI/SRP/blk-mq objects within the same host kernel authority and does not cross a VM, IOMMU, or other security-authority boundary.\\nC:H - This is a confirmed KASAN use-after-free in srp_exit_cmd_priv during tag-set free; per kernel guidance a UAF yields an attacker-controllable read primitive via reclaim of the freed object.\\nI:H - Use-after-free of host-associated command-private state during blk_mq_free_tag_set enables heap spray and arbitrary write/control-flow hijack primitives, so integrity impact is High.\\nA:H - The UAF produces a kernel oops/KASAN fault in the exit_cmd_priv path (as in the reported multipathd stack), which is full availability loss even without further exploitation.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"65ca846a53149a1a72cd8d02e7b2e73dd545b834\", \"lessThan\": \"5ce8fad941233e81f2afb5b52a3fcddd3ba8732f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"65ca846a53149a1a72cd8d02e7b2e73dd545b834\", \"lessThan\": \"f818708eeeae793e12dc39f8984ed7732048a7d9\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"65ca846a53149a1a72cd8d02e7b2e73dd545b834\", \"lessThan\": \"2e7eb4c1e8af8385de22775bd0be552f59b28c9a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"65ca846a53149a1a72cd8d02e7b2e73dd545b834\", \"lessThan\": \"8fe4ce5836e932f5766317cb651c1ff2a4cd0506\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/scsi/hosts.c\", \"drivers/scsi/scsi_lib.c\", \"drivers/scsi/scsi_priv.h\", \"drivers/scsi/scsi_scan.c\", \"drivers/scsi/scsi_sysfs.c\", \"include/scsi/scsi_host.h\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.7\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.7\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.223\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.164\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"5.19.12\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.19.*\"}, {\"status\": \"unaffected\", \"version\": \"6.0\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/scsi/hosts.c\", \"drivers/scsi/scsi_lib.c\", \"drivers/scsi/scsi_priv.h\", \"drivers/scsi/scsi_scan.c\", \"drivers/scsi/scsi_sysfs.c\", \"include/scsi/scsi_host.h\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/5ce8fad941233e81f2afb5b52a3fcddd3ba8732f\"}, {\"url\": \"https://git.kernel.org/stable/c/f818708eeeae793e12dc39f8984ed7732048a7d9\"}, {\"url\": \"https://git.kernel.org/stable/c/2e7eb4c1e8af8385de22775bd0be552f59b28c9a\"}, {\"url\": \"https://git.kernel.org/stable/c/8fe4ce5836e932f5766317cb651c1ff2a4cd0506\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nscsi: core: Fix a use-after-free\\n\\nThere are two .exit_cmd_priv implementations. Both implementations use\\nresources associated with the SCSI host. Make sure that these resources are\\nstill available when .exit_cmd_priv is called by waiting inside\\nscsi_remove_host() until the tag set has been freed.\\n\\nThis commit fixes the following use-after-free:\\n\\n==================================================================\\nBUG: KASAN: use-after-free in srp_exit_cmd_priv+0x27/0xd0 [ib_srp]\\nRead of size 8 at addr ffff888100337000 by task multipathd/16727\\nCall Trace:\\n \u003cTASK\u003e\\n dump_stack_lvl+0x34/0x44\\n print_report.cold+0x5e/0x5db\\n kasan_report+0xab/0x120\\n srp_exit_cmd_priv+0x27/0xd0 [ib_srp]\\n scsi_mq_exit_request+0x4d/0x70\\n blk_mq_free_rqs+0x143/0x410\\n __blk_mq_free_map_and_rqs+0x6e/0x100\\n blk_mq_free_tag_set+0x2b/0x160\\n scsi_host_dev_release+0xf3/0x1a0\\n device_release+0x54/0xe0\\n kobject_put+0xa5/0x120\\n device_release+0x54/0xe0\\n kobject_put+0xa5/0x120\\n scsi_device_dev_release_usercontext+0x4c1/0x4e0\\n execute_in_process_context+0x23/0x90\\n device_release+0x54/0xe0\\n kobject_put+0xa5/0x120\\n scsi_disk_release+0x3f/0x50\\n device_release+0x54/0xe0\\n kobject_put+0xa5/0x120\\n disk_release+0x17f/0x1b0\\n device_release+0x54/0xe0\\n kobject_put+0xa5/0x120\\n dm_put_table_device+0xa3/0x160 [dm_mod]\\n dm_put_device+0xd0/0x140 [dm_mod]\\n free_priority_group+0xd8/0x110 [dm_multipath]\\n free_multipath+0x94/0xe0 [dm_multipath]\\n dm_table_destroy+0xa2/0x1e0 [dm_mod]\\n __dm_destroy+0x196/0x350 [dm_mod]\\n dev_remove+0x10c/0x160 [dm_mod]\\n ctl_ioctl+0x2c2/0x590 [dm_mod]\\n dm_ctl_ioctl+0x5/0x10 [dm_mod]\\n __x64_sys_ioctl+0xb4/0xf0\\n dm_ctl_ioctl+0x5/0x10 [dm_mod]\\n __x64_sys_ioctl+0xb4/0xf0\\n do_syscall_64+0x3b/0x90\\n entry_SYSCALL_64_after_hwframe+0x46/0xb0\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.223\", \"versionStartIncluding\": \"5.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.164\", \"versionStartIncluding\": \"5.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.19.12\", \"versionStartIncluding\": \"5.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.0\", \"versionStartIncluding\": \"5.7\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:51:41.922Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-48666\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:51:41.922Z\", \"dateReserved\": \"2024-02-25T13:44:28.320Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-04-28T13:01:50.526Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.