Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2022-48797— mm: don't try to NUMA-migrate COW pages that have other uses

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于mm模块中发现NUMA迁移问题。在启用NUMA平衡时，可能会导致数据损坏。

CVSS 7.1 · High EPSS 0.24% · P15

Affected Version Matrix 10

VendorProduct Version RangeStatus
Linux Linux 09854ba94c6aad7886996bfbee2530b3d8a7f4f4< 254090925e16abd914c87b4ad1b489440d89c4c3 affected
09854ba94c6aad7886996bfbee2530b3d8a7f4f4< b3dc4b9d3ca68b370c4aeab5355007eedf948849 affected
09854ba94c6aad7886996bfbee2530b3d8a7f4f4< d187eeb02d18446e5e54ed6bcbf8b47e6551daea affected
09854ba94c6aad7886996bfbee2530b3d8a7f4f4< 80d47f5de5e311cbc0d01ebb6ee684e8f4c196c6 affected
5.9 affected
< 5.9 unaffected
5.10.102≤ 5.10.* unaffected
5.15.25≤ 5.15.* unaffected
… +2 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2022-48797

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
mm: don't try to NUMA-migrate COW pages that have other uses
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: mm: don't try to NUMA-migrate COW pages that have other uses Oded Gabbay reports that enabling NUMA balancing causes corruption with his Gaudi accelerator test load: "All the details are in the bug, but the bottom line is that somehow, this patch causes corruption when the numa balancing feature is enabled AND we don't use process affinity AND we use GUP to pin pages so our accelerator can DMA to/from system memory. Either disabling numa balancing, using process affinity to bind to specific numa-node or reverting this patch causes the bug to disappear" and Oded bisected the issue to commit 09854ba94c6a ("mm: do_wp_page() simplification"). Now, the NUMA balancing shouldn't actually be changing the writability of a page, and as such shouldn't matter for COW. But it appears it does. Suspicious. However, regardless of that, the condition for enabling NUMA faults in change_pte_range() is nonsensical. It uses "page_mapcount(page)" to decide if a COW page should be NUMA-protected or not, and that makes absolutely no sense. The number of mappings a page has is irrelevant: not only does GUP get a reference to a page as in Oded's case, but the other mappings migth be paged out and the only reference to them would be in the page count. Since we should never try to NUMA-balance a page that we can't move anyway due to other references, just fix the code to use 'page_count()'. Oded confirms that that fixes his issue. Now, this does imply that something in NUMA balancing ends up changing page protections (other than the obvious one of making the page inaccessible to get the NUMA faulting information). Otherwise the COW simplification wouldn't matter - since doing the GUP on the page would make sure it's writable. The cause of that permission change would be good to figure out too, since it clearly results in spurious COW events - but fixing the nonsensical test that just happened to work before is obviously the CorrectThing(tm) to do regardless.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于mm模块中发现NUMA迁移问题。在启用NUMA平衡时，可能会导致数据损坏。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 09854ba94c6aad7886996bfbee2530b3d8a7f4f4 ~ 254090925e16abd914c87b4ad1b489440d89c4c3 -
Linux Linux 5.9 -

II. Public POCs for CVE-2022-48797

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2022-48797

请登录查看更多情报信息。

Other References for CVE-2022-48797 (3)

Same Patch Batch · Linux · 2024-07-16 · 98 CVEs total

CVE-2022-48790 9.8 CRITICAL nvme: fix a possible use-after-free in controller reset during load
CVE-2022-48789 9.8 CRITICAL nvme-tcp: fix possible use-after-free in transport error_recovery work
CVE-2022-48788 9.8 CRITICAL nvme-rdma: fix possible use-after-free in transport error_recovery work
CVE-2022-48851 9.8 CRITICAL staging: gdm724x: fix use after free in gdm_lte_rx()
CVE-2022-48829 9.1 CRITICAL NFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizes
CVE-2022-48828 9.1 CRITICAL NFSD: Fix ia_size underflow
CVE-2022-48864 8.8 HIGH vdpa/mlx5: add validation for VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET command
CVE-2022-48830 8.8 HIGH can: isotp: fix potential CAN frame reception race in isotp_rcv()
CVE-2022-48782 8.8 HIGH mctp: fix use after free
CVE-2022-48785 8.8 HIGH ipv6: mcast: use rcu-safe version of ipv6_get_lladdr()
CVE-2022-48816 7.8 HIGH SUNRPC: lock against ->sock changing during sysfs read
CVE-2022-48791 7.8 HIGH scsi: pm8001: Fix use-after-free for aborted TMF sas_task
CVE-2024-41008 7.8 HIGH drm/amdgpu: change vm->task_info handling
CVE-2022-48821 7.8 HIGH misc: fastrpc: avoid double fput() on failed usercopy
CVE-2022-48822 7.8 HIGH usb: f_fs: Fix use-after-free for epfile
CVE-2022-48801 7.8 HIGH iio: buffer: Fix file related error handling in IIO_BUFFER_GET_FD_IOCTL
CVE-2022-48796 7.8 HIGH iommu: Fix potential use-after-free during probe
CVE-2022-48792 7.8 HIGH scsi: pm8001: Fix use-after-free for aborted SSP/STP sas_task
CVE-2022-48786 7.8 HIGH vsock: remove vsock from connected table when connect is interrupted by a signal
CVE-2022-48787 7.8 HIGH iwlwifi: fix use-after-free

Showing top 20 of 98 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2022-48797

No comments yet

Leave a comment