CVE-2022-48941

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2022-48941", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-08-22T01:27:53.623Z", "datePublished": "2024-08-22T03:31:37.120Z", "dateUpdated": "2026-08-05T08:53:02.339Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:53:02.339Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: fix concurrent reset and removal of VFs\n\nCommit c503e63200c6 (\"ice: Stop processing VF messages during teardown\")\nintroduced a driver state flag, ICE_VF_DEINIT_IN_PROGRESS, which is\nintended to prevent some issues with concurrently handling messages from\nVFs while tearing down the VFs.\n\nThis change was motivated by crashes caused while tearing down and\nbringing up VFs in rapid succession.\n\nIt turns out that the fix actually introduces issues with the VF driver\ncaused because the PF no longer responds to any messages sent by the VF\nduring its .remove routine. This results in the VF potentially removing\nits DMA memory before the PF has shut down the device queues.\n\nAdditionally, the fix doesn't actually resolve concurrency issues within\nthe ice driver. It is possible for a VF to initiate a reset just prior\nto the ice driver removing VFs. This can result in the remove task\nconcurrently operating while the VF is being reset. This results in\nsimilar memory corruption and panics purportedly fixed by that commit.\n\nFix this concurrency at its root by protecting both the reset and\nremoval flows using the existing VF cfg_lock. This ensures that we\ncannot remove the VF while any outstanding critical tasks such as a\nvirtchnl message or a reset are occurring.\n\nThis locking change also fixes the root cause originally fixed by commit\nc503e63200c6 (\"ice: Stop processing VF messages during teardown\"), so we\ncan simply revert it.\n\nNote that I kept these two changes together because simply reverting the\noriginal commit alone would leave the driver vulnerable to worse race\nconditions."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable paths are reached via the local SR-IOV VF mailbox/VFLR interface (virtchnl ops, PCI FLR, or host sriov_numvfs teardown), not by parsing remote network packets.\nAC:L - A VF tenant can drive both sides of the race by issuing concurrent VFLR and virtchnl operations (or reset alongside host VF teardown), so success does not depend on conditions outside attacker control.\nPR:L - In the worst reasonable deployment an SR-IOV VF is assigned to a guest or delegated container, which can issue VFLR/virtchnl resets against the host ice PF driver without host root or init-namespace CAP_SYS_ADMIN.\nUI:N - The attacker unilaterally triggers VF reset and concurrent virtchnl/teardown activity; no separate victim action is required.\nS:C - A malicious VF guest induces use-after-free/memory corruption in the host PF ice driver, crossing the guest/host security boundary and affecting the hypervisor and co-tenants.\nC:H - Concurrent reset versus virtchnl/removal frees and reuses VF/VSI objects while still in use, yielding a use-after-free that can be leveraged for arbitrary kernel memory disclosure.\nI:H - The same UAF/memory corruption on host PF VF/VSI structures provides a write primitive usable for kernel integrity compromise and control-flow hijacking.\nA:H - The commit documents memory corruption and kernel panics from the concurrent reset/removal race, which is Availability High."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/intel/ice/ice.h", "drivers/net/ethernet/intel/ice/ice_main.c", "drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c"], "versions": [{"version": "c503e63200c679e362afca7aca9d3dc63a0f45ed", "lessThan": "3c805fce07c9dbc47d8a9129c7c5458025951957", "status": "affected", "versionType": "git"}, {"version": "c503e63200c679e362afca7aca9d3dc63a0f45ed", "lessThan": "2a3e61de89bab6696aa28b70030eb119968c5586", "status": "affected", "versionType": "git"}, {"version": "c503e63200c679e362afca7aca9d3dc63a0f45ed", "lessThan": "fadead80fe4c033b5e514fcbadd20b55c4494112", "status": "affected", "versionType": "git"}, {"version": "8a08142433624fd1088bc8c13639408cf4e1707c", "status": "affected", "versionType": "git"}, {"version": "5.13.12", "lessThan": "5.14", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/intel/ice/ice.h", "drivers/net/ethernet/intel/ice/ice_main.c", "drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c"], "versions": [{"version": "5.14", "status": "affected"}, {"version": "0", "lessThan": "5.14", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.26", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.16.12", "lessThanOrEqual": "5.16.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.17", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "5.15.26"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "5.16.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "5.17"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13.12"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3c805fce07c9dbc47d8a9129c7c5458025951957"}, {"url": "https://git.kernel.org/stable/c/2a3e61de89bab6696aa28b70030eb119968c5586"}, {"url": "https://git.kernel.org/stable/c/fadead80fe4c033b5e514fcbadd20b55c4494112"}], "title": "ice: fix concurrent reset and removal of VFs", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-48941", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T15:32:17.899011Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-12T17:32:59.101Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-48941", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T15:32:17.899011Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:12.587Z"}}], "cna": {"title": "ice: fix concurrent reset and removal of VFs", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable paths are reached via the local SR-IOV VF mailbox/VFLR interface (virtchnl ops, PCI FLR, or host sriov_numvfs teardown), not by parsing remote network packets.\nAC:L - A VF tenant can drive both sides of the race by issuing concurrent VFLR and virtchnl operations (or reset alongside host VF teardown), so success does not depend on conditions outside attacker control.\nPR:L - In the worst reasonable deployment an SR-IOV VF is assigned to a guest or delegated container, which can issue VFLR/virtchnl resets against the host ice PF driver without host root or init-namespace CAP_SYS_ADMIN.\nUI:N - The attacker unilaterally triggers VF reset and concurrent virtchnl/teardown activity; no separate victim action is required.\nS:C - A malicious VF guest induces use-after-free/memory corruption in the host PF ice driver, crossing the guest/host security boundary and affecting the hypervisor and co-tenants.\nC:H - Concurrent reset versus virtchnl/removal frees and reuses VF/VSI objects while still in use, yielding a use-after-free that can be leveraged for arbitrary kernel memory disclosure.\nI:H - The same UAF/memory corruption on host PF VF/VSI structures provides a write primitive usable for kernel integrity compromise and control-flow hijacking.\nA:H - The commit documents memory corruption and kernel panics from the concurrent reset/removal race, which is Availability High."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "c503e63200c679e362afca7aca9d3dc63a0f45ed", "lessThan": "3c805fce07c9dbc47d8a9129c7c5458025951957", "versionType": "git"}, {"status": "affected", "version": "c503e63200c679e362afca7aca9d3dc63a0f45ed", "lessThan": "2a3e61de89bab6696aa28b70030eb119968c5586", "versionType": "git"}, {"status": "affected", "version": "c503e63200c679e362afca7aca9d3dc63a0f45ed", "lessThan": "fadead80fe4c033b5e514fcbadd20b55c4494112", "versionType": "git"}, {"status": "affected", "version": "8a08142433624fd1088bc8c13639408cf4e1707c", "versionType": "git"}, {"status": "affected", "version": "5.13.12", "lessThan": "5.14", "versionType": "semver"}], "programFiles": ["drivers/net/ethernet/intel/ice/ice.h", "drivers/net/ethernet/intel/ice/ice_main.c", "drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.14"}, {"status": "unaffected", "version": "0", "lessThan": "5.14", "versionType": "semver"}, {"status": "unaffected", "version": "5.15.26", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "5.16.12", "versionType": "semver", "lessThanOrEqual": "5.16.*"}, {"status": "unaffected", "version": "5.17", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/ethernet/intel/ice/ice.h", "drivers/net/ethernet/intel/ice/ice_main.c", "drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/3c805fce07c9dbc47d8a9129c7c5458025951957"}, {"url": "https://git.kernel.org/stable/c/2a3e61de89bab6696aa28b70030eb119968c5586"}, {"url": "https://git.kernel.org/stable/c/fadead80fe4c033b5e514fcbadd20b55c4494112"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: fix concurrent reset and removal of VFs\n\nCommit c503e63200c6 (\"ice: Stop processing VF messages during teardown\")\nintroduced a driver state flag, ICE_VF_DEINIT_IN_PROGRESS, which is\nintended to prevent some issues with concurrently handling messages from\nVFs while tearing down the VFs.\n\nThis change was motivated by crashes caused while tearing down and\nbringing up VFs in rapid succession.\n\nIt turns out that the fix actually introduces issues with the VF driver\ncaused because the PF no longer responds to any messages sent by the VF\nduring its .remove routine. This results in the VF potentially removing\nits DMA memory before the PF has shut down the device queues.\n\nAdditionally, the fix doesn't actually resolve concurrency issues within\nthe ice driver. It is possible for a VF to initiate a reset just prior\nto the ice driver removing VFs. This can result in the remove task\nconcurrently operating while the VF is being reset. This results in\nsimilar memory corruption and panics purportedly fixed by that commit.\n\nFix this concurrency at its root by protecting both the reset and\nremoval flows using the existing VF cfg_lock. This ensures that we\ncannot remove the VF while any outstanding critical tasks such as a\nvirtchnl message or a reset are occurring.\n\nThis locking change also fixes the root cause originally fixed by commit\nc503e63200c6 (\"ice: Stop processing VF messages during teardown\"), so we\ncan simply revert it.\n\nNote that I kept these two changes together because simply reverting the\noriginal commit alone would leave the driver vulnerable to worse race\nconditions."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.26", "versionStartIncluding": "5.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.16.12", "versionStartIncluding": "5.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.17", "versionStartIncluding": "5.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "5.13.12"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:53:02.339Z"}}}, "cveMetadata": {"cveId": "CVE-2022-48941", "state": "PUBLISHED", "dateUpdated": "2026-08-05T08:53:02.339Z", "dateReserved": "2024-08-22T01:27:53.623Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-08-22T03:31:37.120Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/intel/ice/ice.h", "drivers/net/ethernet/intel/ice/ice_main.c", "drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3c805fce07c9dbc47d8a9129c7c5458025951957", "status": "affected", "version": "c503e63200c679e362afca7aca9d3dc63a0f45ed", "versionType": "git"}, {"lessThan": "2a3e61de89bab6696aa28b70030eb119968c5586", "status": "affected", "version": "c503e63200c679e362afca7aca9d3dc63a0f45ed", "versionType": "git"}, {"lessThan": "fadead80fe4c033b5e514fcbadd20b55c4494112", "status": "affected", "version": "c503e63200c679e362afca7aca9d3dc63a0f45ed", "versionType": "git"}, {"status": "affected", "version": "8a08142433624fd1088bc8c13639408cf4e1707c", "versionType": "git"}, {"lessThan": "5.14", "status": "affected", "version": "5.13.12", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/intel/ice/ice.h", "drivers/net/ethernet/intel/ice/ice_main.c", "drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.14"}, {"lessThan": "5.14", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.26", "versionType": "semver"}, {"lessThanOrEqual": "5.16.*", "status": "unaffected", "version": "5.16.12", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "5.17", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "11A056EC-CCC4-4F9D-8466-75C8592015D0", "versionEndExcluding": "5.10.104", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9AB342AE-A62E-4947-A6EA-511453062B2B", "versionEndExcluding": "5.15.26", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C76BAB21-7F23-4AD8-A25F-CA7B262A2698", "versionEndExcluding": "5.16.12", "versionStartIncluding": "5.16", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: fix concurrent reset and removal of VFs\n\nCommit c503e63200c6 (\"ice: Stop processing VF messages during teardown\")\nintroduced a driver state flag, ICE_VF_DEINIT_IN_PROGRESS, which is\nintended to prevent some issues with concurrently handling messages from\nVFs while tearing down the VFs.\n\nThis change was motivated by crashes caused while tearing down and\nbringing up VFs in rapid succession.\n\nIt turns out that the fix actually introduces issues with the VF driver\ncaused because the PF no longer responds to any messages sent by the VF\nduring its .remove routine. This results in the VF potentially removing\nits DMA memory before the PF has shut down the device queues.\n\nAdditionally, the fix doesn't actually resolve concurrency issues within\nthe ice driver. It is possible for a VF to initiate a reset just prior\nto the ice driver removing VFs. This can result in the remove task\nconcurrently operating while the VF is being reset. This results in\nsimilar memory corruption and panics purportedly fixed by that commit.\n\nFix this concurrency at its root by protecting both the reset and\nremoval flows using the existing VF cfg_lock. This ensures that we\ncannot remove the VF while any outstanding critical tasks such as a\nvirtchnl message or a reset are occurring.\n\nThis locking change also fixes the root cause originally fixed by commit\nc503e63200c6 (\"ice: Stop processing VF messages during teardown\"), so we\ncan simply revert it.\n\nNote that I kept these two changes together because simply reverting the\noriginal commit alone would leave the driver vulnerable to worse race\nconditions."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ice: corrige el restablecimiento y la eliminaci\u00f3n simult\u00e1neos de VF. El commit c503e63200c6 (\"ice: deja de procesar mensajes VF durante el desmontaje\") introdujo un indicador de estado del controlador, ICE_VF_DEINIT_IN_PROGRESS, cuyo objetivo es evitar algunos problemas con el manejo simult\u00e1neo de mensajes de VF mientras se derriban los VF. Este cambio fue motivado por accidentes causados al derribar y levantar VF en r\u00e1pida sucesi\u00f3n. Resulta que la soluci\u00f3n en realidad introduce problemas con el controlador VF causados porque el PF ya no responde a ning\u00fan mensaje enviado por el VF durante su rutina .remove. Esto da como resultado que el VF elimine potencialmente su memoria DMA antes de que el PF haya cerrado las colas de dispositivos. Adem\u00e1s, la soluci\u00f3n en realidad no resuelve los problemas de concurrencia dentro del controlador Ice. Es posible que un VF inicie un reinicio justo antes de que el driver de hielo elimine los VF. Esto puede provocar que la tarea de eliminaci\u00f3n funcione simult\u00e1neamente mientras se restablece el VF. Esto da como resultado una corrupci\u00f3n de memoria similar y p\u00e1nicos supuestamente solucionados por esa confirmaci\u00f3n. Corrija esta simultaneidad desde la ra\u00edz protegiendo los flujos de reinicio y eliminaci\u00f3n utilizando el VF cfg_lock existente. Esto garantiza que no podamos eliminar el VF mientras se est\u00e9n realizando tareas cr\u00edticas pendientes, como un mensaje virtchnl o un reinicio. Este cambio de bloqueo tambi\u00e9n soluciona la causa ra\u00edz solucionada originalmente mediante el commit c503e63200c6 (\"ice: Detener el procesamiento de mensajes VF durante el desmontaje\"), por lo que simplemente podemos revertirlo. Tenga en cuenta que mantuve estos dos cambios juntos porque simplemente revertir el compromiso original dejar\u00eda al driver vulnerable a peores condiciones de ejecuci\u00f3n."}], "id": "CVE-2022-48941", "lastModified": "2026-08-04T10:17:27.503", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 6.0, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2022-48941", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T15:32:17.899011Z", "version": "2.0.3"}}]}, "published": "2024-08-22T04:15:17.967", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2a3e61de89bab6696aa28b70030eb119968c5586"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3c805fce07c9dbc47d8a9129c7c5458025951957"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/fadead80fe4c033b5e514fcbadd20b55c4494112"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: ice: fix concurrent reset and removal of VFs", "id": "2307197", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2307197"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H", "status": "draft"}, "cwe": "CWE-362", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nice: fix concurrent reset and removal of VFs\nCommit c503e63200c6 (\"ice: Stop processing VF messages during teardown\")\nintroduced a driver state flag, ICE_VF_DEINIT_IN_PROGRESS, which is\nintended to prevent some issues with concurrently handling messages from\nVFs while tearing down the VFs.\nThis change was motivated by crashes caused while tearing down and\nbringing up VFs in rapid succession.\nIt turns out that the fix actually introduces issues with the VF driver\ncaused because the PF no longer responds to any messages sent by the VF\nduring its .remove routine. This results in the VF potentially removing\nits DMA memory before the PF has shut down the device queues.\nAdditionally, the fix doesn't actually resolve concurrency issues within\nthe ice driver. It is possible for a VF to initiate a reset just prior\nto the ice driver removing VFs. This can result in the remove task\nconcurrently operating while the VF is being reset. This results in\nsimilar memory corruption and panics purportedly fixed by that commit.\nFix this concurrency at its root by protecting both the reset and\nremoval flows using the existing VF cfg_lock. This ensures that we\ncannot remove the VF while any outstanding critical tasks such as a\nvirtchnl message or a reset are occurring.\nThis locking change also fixes the root cause originally fixed by commit\nc503e63200c6 (\"ice: Stop processing VF messages during teardown\"), so we\ncan simply revert it.\nNote that I kept these two changes together because simply reverting the\noriginal commit alone would leave the driver vulnerable to worse race\nconditions."], "name": "CVE-2022-48941", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-08-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2022-48941\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-48941\nhttps://lore.kernel.org/linux-cve-announce/2024082226-CVE-2022-48941-32f7@gregkh/T"], "threat_severity": "Moderate"}

{}