CVE-2022-48868

published 2024-08-21

CVE-2022-48868: In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Let probe fail when workqueue cannot be enabled The workqueue is enabled…

Priority P4 19 medium 5.5 CVSS 3.1

AV L AC L PR L UI N S U C N I N A H

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: idxd: Let probe fail when workqueue cannot be enabled

The workqueue is enabled when the appropriate driver is loaded and
disabled when the driver is removed. When the driver is removed it
assumes that the workqueue was enabled successfully and proceeds to
free allocations made during workqueue enabling.

Failure during workqueue enabling does not prevent the driver from
being loaded. This is because the error path within drv_enable_wq()
returns success unless a second failure is encountered
during the error path. By returning success it is possible to load
the driver even if the workqueue cannot be enabled and
allocations that do not exist are attempted to be freed during
driver remove.

Some examples of problematic flows:
(a)

idxd_dmaengine_drv_probe() -> drv_enable_wq() -> idxd_wq_request_irq():
In above flow, if idxd_wq_request_irq() fails then
idxd_wq_unmap_portal() is called on error exit path, but
drv_enable_wq() returns 0 because idxd_wq_disable() succeeds. The
driver is thus loaded successfully.

idxd_dmaengine_drv_remove()->drv_disable_wq()->idxd_wq_unmap_portal()
Above flow on driver unload triggers the WARN in devm_iounmap() because
the device resource has already been removed during error path of
drv_enable_wq().

(b)

idxd_dmaengine_drv_probe() -> drv_enable_wq() -> idxd_wq_request_irq():
In above flow, if idxd_wq_request_irq() fails then
idxd_wq_init_percpu_ref() is never called to initialize the percpu
counter, yet the driver loads successfully because drv_enable_wq()
returns 0.

idxd_dmaengine_drv_remove()->__idxd_wq_quiesce()->percpu_ref_kill():
Above flow on driver unload triggers a BUG when attempting to drop the
initial ref of the uninitialized percpu ref:
BUG: kernel NULL pointer dereference, address: 0000000000000010

Fix the drv_enable_wq() error path by returning the original error that
indicates failure of workqueue enabling. This ensures that the probe
fails w

Affected

10 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 6.1.8-1 (bookworm)	linux 6.1.8-1 (bookworm)
linux	linux	—	—
linux	linux	>= 1f2bb40337f0df1d9af80793e9fdacff7706e654 < 0f150134dd795ffcd60b798a85ab737d8d010fb7	0f150134dd795ffcd60b798a85ab737d8d010fb7
linux	linux	>= 1f2bb40337f0df1d9af80793e9fdacff7706e654 < 99dc4520b74e7ca8e9dc9abe37a0b10b49467960	99dc4520b74e7ca8e9dc9abe37a0b10b49467960
linux	linux	>= 1f2bb40337f0df1d9af80793e9fdacff7706e654 < b51b75f0604f17c0f6f3b6f68f1a521a5cc6b04f	b51b75f0604f17c0f6f3b6f68f1a521a5cc6b04f
linux	linux_kernel	>= 0 < 6.1.8-1	6.1.8-1
linux	linux_kernel	>= 0 < 6.1.8-1	6.1.8-1
linux	linux_kernel	>= 0 < 6.1.8-1	6.1.8-1
linux	linux_kernel	>= 5.15 < 5.15.90	5.15.90
linux	linux_kernel	>= 5.16 < 6.1.8	6.1.8

CVSS provenance

nvd v3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

osv 5.5 MEDIUM

vendor_debian 5.5 MEDIUM

vendor_redhat 5.5 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-476