CVE-2022-48991
published 2024-10-21CVE-2022-48991: In the Linux kernel, the following vulnerability has been resolved: mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths Any codepath that zaps…
PriorityP338high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.25%
16.6th percentile
In the Linux kernel, the following vulnerability has been resolved:
mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths
Any codepath that zaps page table entries must invoke MMU notifiers to
ensure that secondary MMUs (like KVM) don't keep accessing pages which
aren't mapped anymore. Secondary MMUs don't hold their own references to
pages that are mirrored over, so failing to notify them can lead to page
use-after-free.
I'm marking this as addressing an issue introduced in commit f3f0e1d2150b
("khugepaged: add support of collapse for tmpfs/shmem pages"), but most of
the security impact of this only came in commit 27e1f8273113 ("khugepaged:
enable collapse pmd for pte-mapped THP"), which actually omitted flushes
for the removal of present PTEs, not just for the removal of empty page
tables.
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.4-1 (bookworm) | linux 6.1.4-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= f3f0e1d2150b2b99da2cbdfaad000089efe9bf30 < 275c626c131cfe141beeb6c575e31fa53d32da19 | 275c626c131cfe141beeb6c575e31fa53d32da19 |
| linux | linux | >= f3f0e1d2150b2b99da2cbdfaad000089efe9bf30 < c23105673228c349739e958fa33955ed8faddcaf | c23105673228c349739e958fa33955ed8faddcaf |
| linux | linux | >= f3f0e1d2150b2b99da2cbdfaad000089efe9bf30 < ff2a1a6f869650aec99e9d070b5ab625bfbc5bc3 | ff2a1a6f869650aec99e9d070b5ab625bfbc5bc3 |
| linux | linux | >= f3f0e1d2150b2b99da2cbdfaad000089efe9bf30 < 5ffc2a75534d9d74d49760f983f8eb675fa63d69 | 5ffc2a75534d9d74d49760f983f8eb675fa63d69 |
| linux | linux | >= f3f0e1d2150b2b99da2cbdfaad000089efe9bf30 < 7f445ca2e0e59c7971d0b7b853465e50844ab596 | 7f445ca2e0e59c7971d0b7b853465e50844ab596 |
| linux | linux | >= f3f0e1d2150b2b99da2cbdfaad000089efe9bf30 < 1a3f8c6cd29d9078cc81b29d39d0e9ae1d6a03c3 | 1a3f8c6cd29d9078cc81b29d39d0e9ae1d6a03c3 |
| linux | linux | >= f3f0e1d2150b2b99da2cbdfaad000089efe9bf30 < 5450535901d89a5dcca5fbbc59a24fe89caeb465 | 5450535901d89a5dcca5fbbc59a24fe89caeb465 |
| linux | linux | >= f3f0e1d2150b2b99da2cbdfaad000089efe9bf30 < f268f6cf875f3220afc77bdd0bf1bb136eb54db9 | f268f6cf875f3220afc77bdd0bf1bb136eb54db9 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.162-1 | 5.10.162-1 |
| linux | linux_kernel | >= 0 < 6.1.4-1 | 6.1.4-1 |
| linux | linux_kernel | >= 0 < 6.1.4-1 | 6.1.4-1 |
| linux | linux_kernel | >= 0 < 6.1.4-1 | 6.1.4-1 |
| linux | linux_kernel | >= 4.10 < 4.14.303 | 4.14.303 |
| linux | linux_kernel | >= 4.15 < 4.19.270 | 4.19.270 |
| linux | linux_kernel | >= 4.20 < 5.4.227 | 5.4.227 |
| linux | linux_kernel | >= 4.8 < 4.9.337 | 4.9.337 |
| linux | linux_kernel | >= 5.11 < 5.15.83 | 5.15.83 |
| linux | linux_kernel | >= 5.16 < 6.0.13 | 6.0.13 |
| linux | linux_kernel | >= 5.5 < 5.10.159 | 5.10.159 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2022-48991: In the Linux kernel, the following vulnerability has been resolved: mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths Any codepath that
osv·2024-10-21·CVSS 7.8
CVE-2022-48991 [HIGH] CVE-2022-48991: In the Linux kernel, the following vulnerability has been resolved: mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths Any codepath that
In the Linux kernel, the following vulnerability has been resolved: mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths Any codepath that zaps page table entries must invoke MMU notifiers to ensure that secondary MMUs (like KVM) don't keep accessing pages which aren't mapped anymore. Secondary MMUs don't hold their own references to pages that are mirrored over, so failing to notify them can lead to page use-after-free. I'm marking this as addressing an issue introduced in commit f3f0e1d2150b ("khugepaged: add support of collapse for tmpfs/shmem pages"), but most of the security impact of this only came in commit 27e1f8273113 ("khugepaged: enable collapse pmd for pte-mapped THP"), which actually omitted flushes for the removal of present PTEs, not just for the removal of empty
GHSA
GHSA-8xxh-66cx-j9cj: In the Linux kernel, the following vulnerability has been resolved:
mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths
Any codepath th
ghsa_unreviewed·2024-10-21
CVE-2022-48991 [HIGH] CWE-416 GHSA-8xxh-66cx-j9cj: In the Linux kernel, the following vulnerability has been resolved:
mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths
Any codepath th
In the Linux kernel, the following vulnerability has been resolved:
mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths
Any codepath that zaps page table entries must invoke MMU notifiers to
ensure that secondary MMUs (like KVM) don't keep accessing pages which
aren't mapped anymore. Secondary MMUs don't hold their own references to
pages that are mirrored over, so failing to notify them can lead to page
use-after-free.
I'm marking this as addressing an issue introduced in commit f3f0e1d2150b
("khugepaged: add support of collapse for tmpfs/shmem pages"), but most of
the security impact of this only came in commit 27e1f8273113 ("khugepaged:
enable collapse pmd for pte-mapped THP"), which actually omitted flushes
for the removal of present PTEs, not just for the removal of em
Red Hat
kernel: mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths
vendor_redhat·2024-10-21·CVSS 7.8
CVE-2022-48991 [HIGH] CWE-416 kernel: mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths
kernel: mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths
In the Linux kernel, the following vulnerability has been resolved:
mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths
Any codepath that zaps page table entries must invoke MMU notifiers to
ensure that secondary MMUs (like KVM) don't keep accessing pages which
aren't mapped anymore. Secondary MMUs don't hold their own references to
pages that are mirrored over, so failing to notify them can lead to page
use-after-free.
I'm marking this as addressing an issue introduced in commit f3f0e1d2150b
("khugepaged: add support of collapse for tmpfs/shmem pages"), but most of
the security impact of this only came in commit 27e1f8273113 ("khugepaged:
enable collapse pmd for pte-mapped THP"), which actually omitted
Debian
CVE-2022-48991: linux - In the Linux kernel, the following vulnerability has been resolved: mm/khugepag...
vendor_debian·2022·CVSS 7.8
CVE-2022-48991 [HIGH] CVE-2022-48991: linux - In the Linux kernel, the following vulnerability has been resolved: mm/khugepag...
In the Linux kernel, the following vulnerability has been resolved: mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths Any codepath that zaps page table entries must invoke MMU notifiers to ensure that secondary MMUs (like KVM) don't keep accessing pages which aren't mapped anymore. Secondary MMUs don't hold their own references to pages that are mirrored over, so failing to notify them can lead to page use-after-free. I'm marking this as addressing an issue introduced in commit f3f0e1d2150b ("khugepaged: add support of collapse for tmpfs/shmem pages"), but most of the security impact of this only came in commit 27e1f8273113 ("khugepaged: enable collapse pmd for pte-mapped THP"), which actually omitted flushes for the removal of present PTEs, not just for the removal of empty
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://git.kernel.org/stable/c/1a3f8c6cd29d9078cc81b29d39d0e9ae1d6a03c3https://git.kernel.org/stable/c/275c626c131cfe141beeb6c575e31fa53d32da19https://git.kernel.org/stable/c/5450535901d89a5dcca5fbbc59a24fe89caeb465https://git.kernel.org/stable/c/5ffc2a75534d9d74d49760f983f8eb675fa63d69https://git.kernel.org/stable/c/7f445ca2e0e59c7971d0b7b853465e50844ab596https://git.kernel.org/stable/c/c23105673228c349739e958fa33955ed8faddcafhttps://git.kernel.org/stable/c/f268f6cf875f3220afc77bdd0bf1bb136eb54db9https://git.kernel.org/stable/c/ff2a1a6f869650aec99e9d070b5ab625bfbc5bc3
2024-10-21
Published