CVE-2022-48759
published 2024-06-20CVE-2022-48759: In the Linux kernel, the following vulnerability has been resolved: rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev struct rpmsg_ctrldev…
PriorityP429high7CVSS 3.1
AVLACHPRLUINSUCHIHAH
EPSS
0.17%
6.8th percentile
In the Linux kernel, the following vulnerability has been resolved:
rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev
struct rpmsg_ctrldev contains a struct cdev. The current code frees
the rpmsg_ctrldev struct in rpmsg_ctrldev_release_device(), but the
cdev is a managed object, therefore its release is not predictable
and the rpmsg_ctrldev could be freed before the cdev is entirely
released, as in the backtrace below.
[ 93.625603] ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x7c
[ 93.636115] WARNING: CPU: 0 PID: 12 at lib/debugobjects.c:488 debug_print_object+0x13c/0x1b0
[ 93.644799] Modules linked in: veth xt_cgroup xt_MASQUERADE rfcomm algif_hash algif_skcipher af_alg uinput ip6table_nat fuse uvcvideo videobuf2_vmalloc venus_enc venus_dec videobuf2_dma_contig hci_uart btandroid btqca snd_soc_rt5682_i2c bluetooth qcom_spmi_temp_alarm snd_soc_rt5682v
[ 93.715175] CPU: 0 PID: 12 Comm: kworker/0:1 Tainted: G B 5.4.163-lockdep #26
[ 93.723855] Hardware name: Google Lazor (rev3 - 8) with LTE (DT)
[ 93.730055] Workqueue: events kobject_delayed_cleanup
[ 93.735271] pstate: 60c00009 (nZCv daif +PAN +UAO)
[ 93.740216] pc : debug_print_object+0x13c/0x1b0
[ 93.744890] lr : debug_print_object+0x13c/0x1b0
[ 93.749555] sp : ffffffacf5bc7940
[ 93.752978] x29: ffffffacf5bc7940 x28: dfffffd000000000
[ 93.758448] x27: ffffffacdb11a800 x26: dfffffd000000000
[ 93.763916] x25: ffffffd0734f856c x24: dfffffd000000000
[ 93.769389] x23: 0000000000000000 x22: ffffffd0733c35b0
[ 93.774860] x21: ffffffd0751994a0 x20: ffffffd075ec27c0
[ 93.780338] x19: ffffffd075199100 x18: 00000000000276e0
[ 93.785814] x17: 0000000000000000 x16: dfffffd000000000
[ 93.791291] x15: ffffffffffffffff x14: 6e6968207473696c
[ 93.796768] x13: 0000000000000000 x12: ffffffd075e2b000
[ 93.802244] x11: 0000000000000001 x10: 0000000000000000
[ 93.807723] x9 : d13400dff1921900 x8 : d13400dff1921900
[ 93.813200] x7 : 0000000000000000 x6 : 00000000000000
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.16.7-1 (bookworm) | linux 5.16.7-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= c0cdc19f84a4712cf74888f83af286e3c2e14efd < 74d85e9fbc7022a4011102c7474a9c7aeb704a35 | 74d85e9fbc7022a4011102c7474a9c7aeb704a35 |
| linux | linux | >= c0cdc19f84a4712cf74888f83af286e3c2e14efd < 70cb4295ec806b663665e1d2ed15caab6159880e | 70cb4295ec806b663665e1d2ed15caab6159880e |
| linux | linux | >= c0cdc19f84a4712cf74888f83af286e3c2e14efd < da27b834c1e0222e149e06caddf7718478086d1b | da27b834c1e0222e149e06caddf7718478086d1b |
| linux | linux | >= c0cdc19f84a4712cf74888f83af286e3c2e14efd < 1dbb206730f3e5ce90014ad569ddf8167ec4124a | 1dbb206730f3e5ce90014ad569ddf8167ec4124a |
| linux | linux | >= c0cdc19f84a4712cf74888f83af286e3c2e14efd < 85aba11a8ea92a8eef2de95ebbe063086fd62d9c | 85aba11a8ea92a8eef2de95ebbe063086fd62d9c |
| linux | linux | >= c0cdc19f84a4712cf74888f83af286e3c2e14efd < d6cdc6ae542845d4d0ac8b6d99362bde7042a3c7 | d6cdc6ae542845d4d0ac8b6d99362bde7042a3c7 |
| linux | linux | >= c0cdc19f84a4712cf74888f83af286e3c2e14efd < b7fb2dad571d1e21173c06cef0bced77b323990a | b7fb2dad571d1e21173c06cef0bced77b323990a |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.103-1 | 5.10.103-1 |
| linux | linux_kernel | >= 0 < 5.16.7-1 | 5.16.7-1 |
| linux | linux_kernel | >= 0 < 5.16.7-1 | 5.16.7-1 |
| linux | linux_kernel | >= 0 < 5.16.7-1 | 5.16.7-1 |
| linux | linux_kernel | >= 4.11 < 4.14.265 | 4.14.265 |
| linux | linux_kernel | >= 4.15 < 4.19.228 | 4.19.228 |
| linux | linux_kernel | >= 4.20 < 5.4.176 | 5.4.176 |
| linux | linux_kernel | >= 5.11 < 5.15.19 | 5.15.19 |
| linux | linux_kernel | >= 5.16 < 5.16.5 | 5.16.5 |
| linux | linux_kernel | >= 5.5 < 5.10.96 | 5.10.96 |
CVSS provenance
nvdv3.17.0HIGHCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.0HIGH
vendor_debian7.0HIGH
vendor_redhat7.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-rfp5-p8gj-qx34: In the Linux kernel, the following vulnerability has been resolved:
rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev
struct rpmsg
ghsa_unreviewed·2024-06-20
CVE-2022-48759 [HIGH] CWE-362 GHSA-rfp5-p8gj-qx34: In the Linux kernel, the following vulnerability has been resolved:
rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev
struct rpmsg
In the Linux kernel, the following vulnerability has been resolved:
rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev
struct rpmsg_ctrldev contains a struct cdev. The current code frees
the rpmsg_ctrldev struct in rpmsg_ctrldev_release_device(), but the
cdev is a managed object, therefore its release is not predictable
and the rpmsg_ctrldev could be freed before the cdev is entirely
released, as in the backtrace below.
[ 93.625603] ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x7c
[ 93.636115] WARNING: CPU: 0 PID: 12 at lib/debugobjects.c:488 debug_print_object+0x13c/0x1b0
[ 93.644799] Modules linked in: veth xt_cgroup xt_MASQUERADE rfcomm algif_hash algif_skcipher af_alg uinput ip6table_nat fuse uvcvideo videobuf2_vmallo
OSV
CVE-2022-48759: In the Linux kernel, the following vulnerability has been resolved: rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev struct rpmsg_c
osv·2024-06-20·CVSS 7.0
CVE-2022-48759 [HIGH] CVE-2022-48759: In the Linux kernel, the following vulnerability has been resolved: rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev struct rpmsg_c
In the Linux kernel, the following vulnerability has been resolved: rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev struct rpmsg_ctrldev contains a struct cdev. The current code frees the rpmsg_ctrldev struct in rpmsg_ctrldev_release_device(), but the cdev is a managed object, therefore its release is not predictable and the rpmsg_ctrldev could be freed before the cdev is entirely released, as in the backtrace below. [ 93.625603] ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x7c [ 93.636115] WARNING: CPU: 0 PID: 12 at lib/debugobjects.c:488 debug_print_object+0x13c/0x1b0 [ 93.644799] Modules linked in: veth xt_cgroup xt_MASQUERADE rfcomm algif_hash algif_skcipher af_alg uinput ip6table_nat fuse uvcvideo videobuf2_vmalloc v
Red Hat
kernel: rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev
vendor_redhat·2024-06-20·CVSS 7.0
CVE-2022-48759 [HIGH] CWE-362 kernel: rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev
kernel: rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev
In the Linux kernel, the following vulnerability has been resolved:
rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev
struct rpmsg_ctrldev contains a struct cdev. The current code frees
the rpmsg_ctrldev struct in rpmsg_ctrldev_release_device(), but the
cdev is a managed object, therefore its release is not predictable
and the rpmsg_ctrldev could be freed before the cdev is entirely
released, as in the backtrace below.
[ 93.625603] ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x7c
[ 93.636115] WARNING: CPU: 0 PID: 12 at lib/debugobjects.c:488 debug_print_object+0x13c/0x1b0
[ 93.644799] Modules linked in: veth xt_cgroup xt_MASQUERADE rfcomm algif_has
Debian
CVE-2022-48759: linux - In the Linux kernel, the following vulnerability has been resolved: rpmsg: char...
vendor_debian·2022·CVSS 7.0
CVE-2022-48759 [HIGH] CVE-2022-48759: linux - In the Linux kernel, the following vulnerability has been resolved: rpmsg: char...
In the Linux kernel, the following vulnerability has been resolved: rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev struct rpmsg_ctrldev contains a struct cdev. The current code frees the rpmsg_ctrldev struct in rpmsg_ctrldev_release_device(), but the cdev is a managed object, therefore its release is not predictable and the rpmsg_ctrldev could be freed before the cdev is entirely released, as in the backtrace below. [ 93.625603] ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x7c [ 93.636115] WARNING: CPU: 0 PID: 12 at lib/debugobjects.c:488 debug_print_object+0x13c/0x1b0 [ 93.644799] Modules linked in: veth xt_cgroup xt_MASQUERADE rfcomm algif_hash algif_skcipher af_alg uinput ip6table_nat fuse uvcvideo videobuf2_vmalloc v
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://git.kernel.org/stable/c/1dbb206730f3e5ce90014ad569ddf8167ec4124ahttps://git.kernel.org/stable/c/70cb4295ec806b663665e1d2ed15caab6159880ehttps://git.kernel.org/stable/c/74d85e9fbc7022a4011102c7474a9c7aeb704a35https://git.kernel.org/stable/c/85aba11a8ea92a8eef2de95ebbe063086fd62d9chttps://git.kernel.org/stable/c/b7fb2dad571d1e21173c06cef0bced77b323990ahttps://git.kernel.org/stable/c/d6cdc6ae542845d4d0ac8b6d99362bde7042a3c7https://git.kernel.org/stable/c/da27b834c1e0222e149e06caddf7718478086d1bhttps://git.kernel.org/stable/c/1dbb206730f3e5ce90014ad569ddf8167ec4124ahttps://git.kernel.org/stable/c/70cb4295ec806b663665e1d2ed15caab6159880ehttps://git.kernel.org/stable/c/74d85e9fbc7022a4011102c7474a9c7aeb704a35https://git.kernel.org/stable/c/85aba11a8ea92a8eef2de95ebbe063086fd62d9chttps://git.kernel.org/stable/c/b7fb2dad571d1e21173c06cef0bced77b323990ahttps://git.kernel.org/stable/c/d6cdc6ae542845d4d0ac8b6d99362bde7042a3c7https://git.kernel.org/stable/c/da27b834c1e0222e149e06caddf7718478086d1b
2024-06-20
Published