CVE-2022-49931

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-49931
In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Correctly move list in sc_disable() Commit 13bac861952a ("IB/hfi1: Fix abba locking issue with sc_disable()") incorrectly tries to move a list from one list head to another. The result is a kernel crash. The crash is triggered when a link goes down and there are waiters for a send to complete. The following signature is seen: BUG: kernel NULL pointer dereference, address: 0000000000000030 [...] Call Trace: sc_disable+0x1ba/0x240 [hfi1] pio_freeze+0x3d/0x60 [hfi1] handle_freeze+0x27/0x1b0 [hfi1] process_one_work+0x1b0/0x380 ? process_one_work+0x380/0x380 worker_thread+0x30/0x360 ? process_one_work+0x380/0x380 kthread+0xd7/0x100 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30 The fix is to use the correct call to move the list.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/1afac08b39d85437187bb2a92d89a741b1078f55 Patch
https://git.kernel.org/stable/c/25760a41e3802f54aadcc31385543665ab349b8e Patch
https://git.kernel.org/stable/c/7c4260f8f188df32414a5ecad63e8b934c2aa3f0 Patch
https://git.kernel.org/stable/c/b8bcff99b07cc175a6ee12a52db51cdd2229586c Patch
https://git.kernel.org/stable/c/ba95409d6b580501ff6d78efd00064f7df669926 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*
History

07 May 2025, 13:29

Type Values Removed Values Added
CWE CWE-476
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
References () https://git.kernel.org/stable/c/1afac08b39d85437187bb2a92d89a741b1078f55 - () https://git.kernel.org/stable/c/1afac08b39d85437187bb2a92d89a741b1078f55 - Patch
References () https://git.kernel.org/stable/c/25760a41e3802f54aadcc31385543665ab349b8e - () https://git.kernel.org/stable/c/25760a41e3802f54aadcc31385543665ab349b8e - Patch
References () https://git.kernel.org/stable/c/7c4260f8f188df32414a5ecad63e8b934c2aa3f0 - () https://git.kernel.org/stable/c/7c4260f8f188df32414a5ecad63e8b934c2aa3f0 - Patch
References () https://git.kernel.org/stable/c/b8bcff99b07cc175a6ee12a52db51cdd2229586c - () https://git.kernel.org/stable/c/b8bcff99b07cc175a6ee12a52db51cdd2229586c - Patch
References () https://git.kernel.org/stable/c/ba95409d6b580501ff6d78efd00064f7df669926 - () https://git.kernel.org/stable/c/ba95409d6b580501ff6d78efd00064f7df669926 - Patch
First Time Linux linux Kernel
Linux
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*

02 May 2025, 13:52

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: IB/hfi1: Mover correctamente la lista en sc_disable(). El commit 13bac861952a ("IB/hfi1: Solucionar el problema de bloqueo de abba con sc_disable()") intenta mover incorrectamente una lista de una cabecera a otra. Esto provoca un fallo del kernel. El fallo se activa cuando un enlace se cae y hay esperas para que se complete un envío. Se observa la siguiente firma: ERROR: desreferencia de puntero nulo del kernel, dirección: 000000000000030 [...] Seguimiento de llamadas: sc_disable+0x1ba/0x240 [hfi1] pio_freeze+0x3d/0x60 [hfi1] handle_freeze+0x27/0x1b0 [hfi1] process_one_work+0x1b0/0x380 ? process_one_work+0x380/0x380 worker_thread+0x30/0x360 ? process_one_work+0x380/0x380 kthread+0xd7/0x100 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30 La solución es utilizar la llamada correcta para mover la lista.

01 May 2025, 15:16

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-01 15:16

Updated : 2025-05-07 13:29

NVD link : CVE-2022-49931

Mitre link : CVE-2022-49931

CVE.ORG link : CVE-2022-49931

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-476

NULL Pointer Dereference