CVE-2022-48671
published 2024-05-03CVE-2022-48671: In the Linux kernel, the following vulnerability has been resolved: cgroup: Add missing cpus_read_lock() to cgroup_attach_task_all() syzbot is hitting…
PriorityP418medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.18%
7.6th percentile
In the Linux kernel, the following vulnerability has been resolved:
cgroup: Add missing cpus_read_lock() to cgroup_attach_task_all()
syzbot is hitting percpu_rwsem_assert_held(&cpu_hotplug_lock) warning at
cpuset_attach() [1], for commit 4f7e7236435ca0ab ("cgroup: Fix
threadgroup_rwsem cpus_read_lock() deadlock") missed that
cpuset_attach() is also called from cgroup_attach_task_all().
Add cpus_read_lock() like what cgroup_procs_write_start() does.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.19.11-1 (bookworm) | linux 5.19.11-1 (bookworm) |
| linux | linux | >= 3bf4bf54069f9b62a54988e5d085023c17a66c90 < 5db17805b6ba4c34dab303f49aea3562fc25af75 | 5db17805b6ba4c34dab303f49aea3562fc25af75 |
| linux | linux | >= 4f7e7236435ca0abe005c674ebd6892c6e83aeb3 < 43626dade36fa74d3329046f4ae2d7fdefe401c6 | 43626dade36fa74d3329046f4ae2d7fdefe401c6 |
| linux | linux | >= 5.10.143 < 5.10.145 | 5.10.145 |
| linux | linux | >= 5.15.68 < 5.15.70 | 5.15.70 |
| linux | linux | >= 5.19.9 < 5.19.11 | 5.19.11 |
| linux | linux | >= 5.4.213 < 5.4.215 | 5.4.215 |
| linux | linux | >= 59c6902a96b4439e07c25ef86a4593bea5481c3b < 07191f984842d50020789ff14c75da436a7f46a9 | 07191f984842d50020789ff14c75da436a7f46a9 |
| linux | linux | >= c0deb027c99c099aa6b831e326bfba802b25e774 < 99bc25748e394d17f9e8b10cc7f273b8e64c1c7e | 99bc25748e394d17f9e8b10cc7f273b8e64c1c7e |
| linux | linux | >= dee1e2b18cf5426eed985512ccc6636ec69dbdd6 < 9f267393b036f1470fb12fb892d59e7ff8aeb58d | 9f267393b036f1470fb12fb892d59e7ff8aeb58d |
| linux | linux | >= e446300968c6bd25d9cd6c33b9600780a39b3975 < 321488cfac7d0eb6d97de467015ff754f85813ff | 321488cfac7d0eb6d97de467015ff754f85813ff |
| linux | linux_kernel | < 5.15.70 | 5.15.70 |
| linux | linux_kernel | >= 0 < 5.10.148-1 | 5.10.148-1 |
| linux | linux_kernel | >= 0 < 5.19.11-1 | 5.19.11-1 |
| linux | linux_kernel | >= 0 < 5.19.11-1 | 5.19.11-1 |
| linux | linux_kernel | >= 0 < 5.19.11-1 | 5.19.11-1 |
| linux | linux_kernel | >= 5.10.143 < 5.10.145 | 5.10.145 |
| linux | linux_kernel | >= 5.19.9 < 5.19.11 | 5.19.11 |
| linux | linux_kernel | >= 5.4.213 < 5.4.215 | 5.4.215 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: cgroup: Add missing cpus_read_lock() to cgroup_attach_task_all()
vendor_redhat·2024-05-03·CVSS 5.5
CVE-2022-48671 [MEDIUM] kernel: cgroup: Add missing cpus_read_lock() to cgroup_attach_task_all()
kernel: cgroup: Add missing cpus_read_lock() to cgroup_attach_task_all()
In the Linux kernel, the following vulnerability has been resolved:
cgroup: Add missing cpus_read_lock() to cgroup_attach_task_all()
syzbot is hitting percpu_rwsem_assert_held(&cpu_hotplug_lock) warning at
cpuset_attach() [1], for commit 4f7e7236435ca0ab ("cgroup: Fix
threadgroup_rwsem cpus_read_lock() deadlock") missed that
cpuset_attach() is also called from cgroup_attach_task_all().
Add cpus_read_lock() like what cgroup_procs_write_start() does.
A flaw was found in the Linux kernel due to a missing `cpus_read_lock()` in the `cgroup_attach_task_all()` function. This issue led to a warning in the `cpuset_attach()` function, triggered by a deadlock between `threadgroup_rwsem` and `cpus_read_lock().`
Statement: Red
Debian
CVE-2022-48671: linux - In the Linux kernel, the following vulnerability has been resolved: cgroup: Add...
vendor_debian·2022·CVSS 5.5
CVE-2022-48671 [MEDIUM] CVE-2022-48671: linux - In the Linux kernel, the following vulnerability has been resolved: cgroup: Add...
In the Linux kernel, the following vulnerability has been resolved: cgroup: Add missing cpus_read_lock() to cgroup_attach_task_all() syzbot is hitting percpu_rwsem_assert_held(&cpu_hotplug_lock) warning at cpuset_attach() [1], for commit 4f7e7236435ca0ab ("cgroup: Fix threadgroup_rwsem cpus_read_lock() deadlock") missed that cpuset_attach() is also called from cgroup_attach_task_all(). Add cpus_read_lock() like what cgroup_procs_write_start() does.
Scope: local
bookworm: resolved (fixed in 5.19.11-1)
bullseye: resolved (fixed in 5.10.148-1)
forky: resolved (fixed in 5.19.11-1)
sid: resolved (fixed in 5.19.11-1)
trixie: resolved (fixed in 5.19.11-1)
OSV
CVE-2022-48671: In the Linux kernel, the following vulnerability has been resolved: cgroup: Add missing cpus_read_lock() to cgroup_attach_task_all() syzbot is hitting
osv·2024-05-03·CVSS 5.5
CVE-2022-48671 [MEDIUM] CVE-2022-48671: In the Linux kernel, the following vulnerability has been resolved: cgroup: Add missing cpus_read_lock() to cgroup_attach_task_all() syzbot is hitting
In the Linux kernel, the following vulnerability has been resolved: cgroup: Add missing cpus_read_lock() to cgroup_attach_task_all() syzbot is hitting percpu_rwsem_assert_held(&cpu_hotplug_lock) warning at cpuset_attach() [1], for commit 4f7e7236435ca0ab ("cgroup: Fix threadgroup_rwsem cpus_read_lock() deadlock") missed that cpuset_attach() is also called from cgroup_attach_task_all(). Add cpus_read_lock() like what cgroup_procs_write_start() does.
GHSA
GHSA-hx7p-6fcf-8gxf: In the Linux kernel, the following vulnerability has been resolved:
cgroup: Add missing cpus_read_lock() to cgroup_attach_task_all()
syzbot is hitti
ghsa_unreviewed·2024-05-03
CVE-2022-48671 [MEDIUM] CWE-667 GHSA-hx7p-6fcf-8gxf: In the Linux kernel, the following vulnerability has been resolved:
cgroup: Add missing cpus_read_lock() to cgroup_attach_task_all()
syzbot is hitti
In the Linux kernel, the following vulnerability has been resolved:
cgroup: Add missing cpus_read_lock() to cgroup_attach_task_all()
syzbot is hitting percpu_rwsem_assert_held(&cpu_hotplug_lock) warning at
cpuset_attach() [1], for commit 4f7e7236435ca0ab ("cgroup: Fix
threadgroup_rwsem cpus_read_lock() deadlock") missed that
cpuset_attach() is also called from cgroup_attach_task_all().
Add cpus_read_lock() like what cgroup_procs_write_start() does.
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/07191f984842d50020789ff14c75da436a7f46a9https://git.kernel.org/stable/c/321488cfac7d0eb6d97de467015ff754f85813ffhttps://git.kernel.org/stable/c/43626dade36fa74d3329046f4ae2d7fdefe401c6https://git.kernel.org/stable/c/5db17805b6ba4c34dab303f49aea3562fc25af75https://git.kernel.org/stable/c/99bc25748e394d17f9e8b10cc7f273b8e64c1c7ehttps://git.kernel.org/stable/c/9f267393b036f1470fb12fb892d59e7ff8aeb58dhttps://git.kernel.org/stable/c/07191f984842d50020789ff14c75da436a7f46a9https://git.kernel.org/stable/c/321488cfac7d0eb6d97de467015ff754f85813ffhttps://git.kernel.org/stable/c/43626dade36fa74d3329046f4ae2d7fdefe401c6https://git.kernel.org/stable/c/5db17805b6ba4c34dab303f49aea3562fc25af75https://git.kernel.org/stable/c/99bc25748e394d17f9e8b10cc7f273b8e64c1c7ehttps://git.kernel.org/stable/c/9f267393b036f1470fb12fb892d59e7ff8aeb58d
2024-05-03
Published