Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2022-49412— bfq: Avoid merging queues with different parents

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于bfq在合并队列时未检查父级是否相同。

CVSS 7.8 · High EPSS 0.28% · P19

Affected Version Matrix 10

VendorProduct Version RangeStatus
Linux Linux 430a67f9d6169a7b3e328bceb2ef9542e4153c7c< 5ee21edaed09e6b25f2c007b3f326752bc89bacf affected
430a67f9d6169a7b3e328bceb2ef9542e4153c7c< a16c65cca7d2c7ff965fdd3adc8df2156529caf1 affected
430a67f9d6169a7b3e328bceb2ef9542e4153c7c< 8abc8763b11c35e03cc91d59fd0cd28d39f88ca9 affected
430a67f9d6169a7b3e328bceb2ef9542e4153c7c< c1cee4ab36acef271be9101590756ed0c0c374d9 affected
5.13 affected
< 5.13 unaffected
5.15.46≤ 5.15.* unaffected
5.17.14≤ 5.17.* unaffected
… +2 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2022-49412

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
bfq: Avoid merging queues with different parents
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: bfq: Avoid merging queues with different parents It can happen that the parent of a bfqq changes between the moment we decide two queues are worth to merge (and set bic->stable_merge_bfqq) and the moment bfq_setup_merge() is called. This can happen e.g. because the process submitted IO for a different cgroup and thus bfqq got reparented. It can even happen that the bfqq we are merging with has parent cgroup that is already offline and going to be destroyed in which case the merge can lead to use-after-free issues such as: BUG: KASAN: use-after-free in __bfq_deactivate_entity+0x9cb/0xa50 Read of size 8 at addr ffff88800693c0c0 by task runc:[2:INIT]/10544 CPU: 0 PID: 10544 Comm: runc:[2:INIT] Tainted: G E 5.15.2-0.g5fb85fd-default #1 openSUSE Tumbleweed (unreleased) f1f3b891c72369aebecd2e43e4641a6358867c70 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a-rebuilt.opensuse.org 04/01/2014 Call Trace: <IRQ> dump_stack_lvl+0x46/0x5a print_address_description.constprop.0+0x1f/0x140 ? __bfq_deactivate_entity+0x9cb/0xa50 kasan_report.cold+0x7f/0x11b ? __bfq_deactivate_entity+0x9cb/0xa50 __bfq_deactivate_entity+0x9cb/0xa50 ? update_curr+0x32f/0x5d0 bfq_deactivate_entity+0xa0/0x1d0 bfq_del_bfqq_busy+0x28a/0x420 ? resched_curr+0x116/0x1d0 ? bfq_requeue_bfqq+0x70/0x70 ? check_preempt_wakeup+0x52b/0xbc0 __bfq_bfqq_expire+0x1a2/0x270 bfq_bfqq_expire+0xd16/0x2160 ? try_to_wake_up+0x4ee/0x1260 ? bfq_end_wr_async_queues+0xe0/0xe0 ? _raw_write_unlock_bh+0x60/0x60 ? _raw_spin_lock_irq+0x81/0xe0 bfq_idle_slice_timer+0x109/0x280 ? bfq_dispatch_request+0x4870/0x4870 __hrtimer_run_queues+0x37d/0x700 ? enqueue_hrtimer+0x1b0/0x1b0 ? kvm_clock_get_cycles+0xd/0x10 ? ktime_get_update_offsets_now+0x6f/0x280 hrtimer_interrupt+0x2c8/0x740 Fix the problem by checking that the parent of the two bfqqs we are merging in bfq_setup_merge() is the same.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于bfq在合并队列时未检查父级是否相同。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 430a67f9d6169a7b3e328bceb2ef9542e4153c7c ~ 5ee21edaed09e6b25f2c007b3f326752bc89bacf -
Linux Linux 5.13 -

II. Public POCs for CVE-2022-49412

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2022-49412

请登录查看更多情报信息。

Patches & Fixes for CVE-2022-49412 (6)

Same Patch Batch · Linux · 2025-02-26 · 706 CVEs total

CVE-2022-49418 9.8 CRITICAL NFSv4: Fix free of uninitialized nfs4_label on referral lookup.
CVE-2022-49407 9.8 CRITICAL dlm: fix plock invalid read
CVE-2022-49362 9.8 CRITICAL NFSD: Fix potential use-after-free in nfsd_file_put()
CVE-2022-49356 9.8 CRITICAL SUNRPC: Trap RDMA segment overflows
CVE-2022-49561 9.8 CRITICAL netfilter: conntrack: re-fetch conntrack after insertion
CVE-2022-49280 9.8 CRITICAL NFSD: prevent underflow in nfssvc_decode_writeargs()
CVE-2022-49260 9.8 CRITICAL crypto: hisilicon/sec - fix the aead software fallback for engine
CVE-2022-49201 9.8 CRITICAL ibmvnic: fix race between xmit and reset
CVE-2022-49094 9.8 CRITICAL net/tls: fix slab-out-of-bounds bug in decrypt_internal
CVE-2022-49194 9.8 CRITICAL net: bcmgenet: Use stronger register read/writes to assure ordering
CVE-2022-49149 9.8 CRITICAL rxrpc: Fix call timer start racing with call destruction
CVE-2022-49093 9.8 CRITICAL skbuff: fix coalescing for page_pool fragment recycling
CVE-2022-49058 9.1 CRITICAL cifs: potential buffer overflow in handling symlinks
CVE-2022-49470 8.8 HIGH Bluetooth: btmtksdio: fix use-after-free at btmtksdio_recv_event
CVE-2022-49500 8.8 HIGH wl1251: dynamically allocate memory used for DMA
CVE-2022-49519 8.8 HIGH ath10k: skip ath10k_halt during suspend for driver state RESTARTING
CVE-2022-49111 8.8 HIGH Bluetooth: Fix use after free in hci_send_acl
CVE-2022-49114 8.8 HIGH scsi: libfc: Fix use after free in fc_exch_abts_resp()
CVE-2022-49238 8.8 HIGH ath11k: free peer for station when disconnect from AP for QCA6390/WCN6855
CVE-2022-49535 8.8 HIGH scsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI

Showing top 20 of 706 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2022-49412

No comments yet

Leave a comment