CVE-2022-49118

published 2025-02-26

CVE-2022-49118: In the Linux kernel, the following vulnerability has been resolved: scsi: hisi_sas: Free irq vectors in order for v3 HW If the driver probe fails to request…

Priority P4 20 medium 5.5 CVSS 3.1

AV L AC L PR L UI N S U C N I N A H

In the Linux kernel, the following vulnerability has been resolved:

scsi: hisi_sas: Free irq vectors in order for v3 HW

If the driver probe fails to request the channel IRQ or fatal IRQ, the
driver will free the IRQ vectors before freeing the IRQs in free_irq(),
and this will cause a kernel BUG like this:

------------[ cut here ]------------
kernel BUG at drivers/pci/msi.c:369!
Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
Call trace:
free_msi_irqs+0x118/0x13c
pci_disable_msi+0xfc/0x120
pci_free_irq_vectors+0x24/0x3c
hisi_sas_v3_probe+0x360/0x9d0 [hisi_sas_v3_hw]
local_pci_probe+0x44/0xb0
work_for_cpu_fn+0x20/0x34
process_one_work+0x1d0/0x340
worker_thread+0x2e0/0x460
kthread+0x180/0x190
ret_from_fork+0x10/0x20
---[ end trace b88990335b610c11 ]---

So we use devm_add_action() to control the order in which we free the
vectors.

Affected

15 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 5.17.3-1 (bookworm)	linux 5.17.3-1 (bookworm)
linux	linux	—	—
linux	linux	>= 47caad1577cd7a39e2048c5e4edbce4b863dc12b < 224903cc60d045576393c3b16907742f23e6c740	224903cc60d045576393c3b16907742f23e6c740
linux	linux	>= 47caad1577cd7a39e2048c5e4edbce4b863dc12b < f05a0d8de2ea49af36821a20b0b501e20ced937e	f05a0d8de2ea49af36821a20b0b501e20ced937e
linux	linux	>= 47caad1577cd7a39e2048c5e4edbce4b863dc12b < 8b6eab9d683bae7f88dc894b8c851f866032301c	8b6eab9d683bae7f88dc894b8c851f866032301c
linux	linux	>= 47caad1577cd7a39e2048c5e4edbce4b863dc12b < b4cc04fa8f1fc3816c8494d77abab3f72b9d2292	b4cc04fa8f1fc3816c8494d77abab3f72b9d2292
linux	linux	>= 47caad1577cd7a39e2048c5e4edbce4b863dc12b < 554fb72ee34f4732c7f694f56c3c6e67790352a0	554fb72ee34f4732c7f694f56c3c6e67790352a0
linux	linux_kernel	>= 0 < 5.10.113-1	5.10.113-1
linux	linux_kernel	>= 0 < 5.17.3-1	5.17.3-1
linux	linux_kernel	>= 0 < 5.17.3-1	5.17.3-1
linux	linux_kernel	>= 0 < 5.17.3-1	5.17.3-1
linux	linux_kernel	>= 4.5 < 5.10.111	5.10.111
linux	linux_kernel	>= 5.11 < 5.15.34	5.15.34
linux	linux_kernel	>= 5.16 < 5.16.20	5.16.20
linux	linux_kernel	>= 5.17 < 5.17.3	5.17.3

CVSS provenance

nvd v3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

osv 5.5 MEDIUM

vendor_debian 5.5 MEDIUM

vendor_redhat 5.5 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-459