CVE-2022-48931
published 2024-08-22CVE-2022-48931: In the Linux kernel, the following vulnerability has been resolved: configfs: fix a race in configfs_{,un}register_subsystem() When…
PriorityP415medium4.7CVSS 3.1
AVLACHPRLUINSUCNINAH
EPSS
0.17%
6.2th percentile
In the Linux kernel, the following vulnerability has been resolved:
configfs: fix a race in configfs_{,un}register_subsystem()
When configfs_register_subsystem() or configfs_unregister_subsystem()
is executing link_group() or unlink_group(),
it is possible that two processes add or delete list concurrently.
Some unfortunate interleavings of them can cause kernel panic.
One of cases is:
A --> B --> C --> D
A prev = prev |
| next->prev = prev
prev->next = next |
| // prev == B
| prev->next = next
Fix this by adding mutex when calling link_group() or unlink_group(),
but parent configfs_subsystem is NULL when config_item is root.
So I create a mutex configfs_subsystem_mutex.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.16.12-1 (bookworm) | linux 5.16.12-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 7063fbf2261194f72ee75afca67b3b38b554b5fa < 40805099af11f68c5ca7dbcfacf455da8f99f622 | 40805099af11f68c5ca7dbcfacf455da8f99f622 |
| linux | linux | >= 7063fbf2261194f72ee75afca67b3b38b554b5fa < d1654de19d42f513b6cfe955cc77e7f427e05a77 | d1654de19d42f513b6cfe955cc77e7f427e05a77 |
| linux | linux | >= 7063fbf2261194f72ee75afca67b3b38b554b5fa < a37024f7757c25550accdebf49e497ad6ae239fe | a37024f7757c25550accdebf49e497ad6ae239fe |
| linux | linux | >= 7063fbf2261194f72ee75afca67b3b38b554b5fa < b7e2b91fcb5c78c414e33dc8d50642e307ca0c5a | b7e2b91fcb5c78c414e33dc8d50642e307ca0c5a |
| linux | linux | >= 7063fbf2261194f72ee75afca67b3b38b554b5fa < a7ab53d3c27dfe83bb594456b9f38a37796ec39b | a7ab53d3c27dfe83bb594456b9f38a37796ec39b |
| linux | linux | >= 7063fbf2261194f72ee75afca67b3b38b554b5fa < e7a66dd2687758718eddd79b542a95cf3aa488cc | e7a66dd2687758718eddd79b542a95cf3aa488cc |
| linux | linux | >= 7063fbf2261194f72ee75afca67b3b38b554b5fa < 3aadfd46858b1f64d4d6a0654b863e21aabff975 | 3aadfd46858b1f64d4d6a0654b863e21aabff975 |
| linux | linux | >= 7063fbf2261194f72ee75afca67b3b38b554b5fa < 84ec758fb2daa236026506868c8796b0500c047d | 84ec758fb2daa236026506868c8796b0500c047d |
| linux | linux_kernel | >= 0 < 5.10.103-1 | 5.10.103-1 |
| linux | linux_kernel | >= 0 < 5.16.12-1 | 5.16.12-1 |
| linux | linux_kernel | >= 0 < 5.16.12-1 | 5.16.12-1 |
| linux | linux_kernel | >= 0 < 5.16.12-1 | 5.16.12-1 |
| linux | linux_kernel | >= 2.6.16 < 4.9.304 | 4.9.304 |
| linux | linux_kernel | >= 4.10 < 4.14.269 | 4.14.269 |
| linux | linux_kernel | >= 4.15 < 4.19.232 | 4.19.232 |
| linux | linux_kernel | >= 4.20 < 5.4.182 | 5.4.182 |
| linux | linux_kernel | >= 5.11 < 5.15.26 | 5.15.26 |
| linux | linux_kernel | >= 5.16 < 5.16.12 | 5.16.12 |
| linux | linux_kernel | >= 5.5 < 5.10.103 | 5.10.103 |
CVSS provenance
nvdv3.14.7MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
osv4.7MEDIUM
vendor_debian4.7MEDIUM
vendor_redhat4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: configfs: fix a race in configfs_{,un}register_subsystem()
vendor_redhat·2024-08-22·CVSS 4.7
CVE-2022-48931 [MEDIUM] CWE-362 kernel: configfs: fix a race in configfs_{,un}register_subsystem()
kernel: configfs: fix a race in configfs_{,un}register_subsystem()
In the Linux kernel, the following vulnerability has been resolved:
configfs: fix a race in configfs_{,un}register_subsystem()
When configfs_register_subsystem() or configfs_unregister_subsystem()
is executing link_group() or unlink_group(),
it is possible that two processes add or delete list concurrently.
Some unfortunate interleavings of them can cause kernel panic.
One of cases is:
A --> B --> C --> D
A prev = prev |
| next->prev = prev
prev->next = next |
| // prev == B
| prev->next = next
Fix this by adding mutex when calling link_group() or unlink_group(),
but parent configfs_subsystem is NULL when config_item is root.
So I create a mutex configfs_subsystem_mutex.
Statement: Following issue marked as moderate with
Debian
CVE-2022-48931: linux - In the Linux kernel, the following vulnerability has been resolved: configfs: f...
vendor_debian·2022·CVSS 4.7
CVE-2022-48931 [MEDIUM] CVE-2022-48931: linux - In the Linux kernel, the following vulnerability has been resolved: configfs: f...
In the Linux kernel, the following vulnerability has been resolved: configfs: fix a race in configfs_{,un}register_subsystem() When configfs_register_subsystem() or configfs_unregister_subsystem() is executing link_group() or unlink_group(), it is possible that two processes add or delete list concurrently. Some unfortunate interleavings of them can cause kernel panic. One of cases is: A --> B --> C --> D A prev = prev | | next->prev = prev prev->next = next | | // prev == B | prev->next = next Fix this by adding mutex when calling link_group() or unlink_group(), but parent configfs_subsystem is NULL when config_item is root. So I create a mutex configfs_subsystem_mutex.
Scope: local
bookworm: resolved (fixed in 5.16.12-1)
bullseye: resolved (fixed in 5.10.103-1)
forky: resolved (fixed in
GHSA
GHSA-38qw-v9q4-hm9j: In the Linux kernel, the following vulnerability has been resolved:
configfs: fix a race in configfs_{,un}register_subsystem()
When configfs_registe
ghsa_unreviewed·2024-08-22
CVE-2022-48931 [MEDIUM] CWE-362 GHSA-38qw-v9q4-hm9j: In the Linux kernel, the following vulnerability has been resolved:
configfs: fix a race in configfs_{,un}register_subsystem()
When configfs_registe
In the Linux kernel, the following vulnerability has been resolved:
configfs: fix a race in configfs_{,un}register_subsystem()
When configfs_register_subsystem() or configfs_unregister_subsystem()
is executing link_group() or unlink_group(),
it is possible that two processes add or delete list concurrently.
Some unfortunate interleavings of them can cause kernel panic.
One of cases is:
A --> B --> C --> D
A prev = prev |
| next->prev = prev
prev->next = next |
| // prev == B
| prev->next = next
Fix this by adding mutex when calling link_group() or unlink_group(),
but parent configfs_subsystem is NULL when config_item is root.
So I create a mutex configfs_subsystem_mutex.
OSV
CVE-2022-48931: In the Linux kernel, the following vulnerability has been resolved: configfs: fix a race in configfs_{,un}register_subsystem() When configfs_register_
osv·2024-08-22·CVSS 4.7
CVE-2022-48931 [MEDIUM] CVE-2022-48931: In the Linux kernel, the following vulnerability has been resolved: configfs: fix a race in configfs_{,un}register_subsystem() When configfs_register_
In the Linux kernel, the following vulnerability has been resolved: configfs: fix a race in configfs_{,un}register_subsystem() When configfs_register_subsystem() or configfs_unregister_subsystem() is executing link_group() or unlink_group(), it is possible that two processes add or delete list concurrently. Some unfortunate interleavings of them can cause kernel panic. One of cases is: A --> B --> C --> D A prev = prev | | next->prev = prev prev->next = next | | // prev == B | prev->next = next Fix this by adding mutex when calling link_group() or unlink_group(), but parent configfs_subsystem is NULL when config_item is root. So I create a mutex configfs_subsystem_mutex.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://git.kernel.org/stable/c/3aadfd46858b1f64d4d6a0654b863e21aabff975https://git.kernel.org/stable/c/40805099af11f68c5ca7dbcfacf455da8f99f622https://git.kernel.org/stable/c/84ec758fb2daa236026506868c8796b0500c047dhttps://git.kernel.org/stable/c/a37024f7757c25550accdebf49e497ad6ae239fehttps://git.kernel.org/stable/c/a7ab53d3c27dfe83bb594456b9f38a37796ec39bhttps://git.kernel.org/stable/c/b7e2b91fcb5c78c414e33dc8d50642e307ca0c5ahttps://git.kernel.org/stable/c/d1654de19d42f513b6cfe955cc77e7f427e05a77https://git.kernel.org/stable/c/e7a66dd2687758718eddd79b542a95cf3aa488cc
2024-08-22
Published