Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2022-49700— mm/slub: add missing TID updates on slab deactivation

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在资源管理错误漏洞，该漏洞源于slab分配器在释放CPU slab时未更新TID，可能导致对象丢失或错误释放。

CVSS 7.8 · High EPSS 0.29% · P21

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 03e404af26dc2ea0d278d7a342de0aab394793ce< 308c6d0e1f200fd26c71270c6e6bfcf0fc6ff082 affected
03e404af26dc2ea0d278d7a342de0aab394793ce< d6a597450e686d4c6388bd3cdcb17224b4dae7f0 affected
03e404af26dc2ea0d278d7a342de0aab394793ce< e2b2f0e2e34d71ae6c2a1114fd3c525930e84bc7 affected
03e404af26dc2ea0d278d7a342de0aab394793ce< e7e3e90d671078455a3a08189f89d85b3da2de9e affected
03e404af26dc2ea0d278d7a342de0aab394793ce< 6c32496964da0dc230cea763a0e934b2e02dabd5 affected
03e404af26dc2ea0d278d7a342de0aab394793ce< 0515cc9b6b24877f59b222ade704bfaa42caa2a6 affected
03e404af26dc2ea0d278d7a342de0aab394793ce< 197e257da473c725dfe47759c3ee02f2398d8ea5 affected
03e404af26dc2ea0d278d7a342de0aab394793ce< eeaa345e128515135ccb864c04482180c08e3259 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2022-49700

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
mm/slub: add missing TID updates on slab deactivation
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: mm/slub: add missing TID updates on slab deactivation The fastpath in slab_alloc_node() assumes that c->slab is stable as long as the TID stays the same. However, two places in __slab_alloc() currently don't update the TID when deactivating the CPU slab. If multiple operations race the right way, this could lead to an object getting lost; or, in an even more unlikely situation, it could even lead to an object being freed onto the wrong slab's freelist, messing up the `inuse` counter and eventually causing a page to be freed to the page allocator while it still contains slab objects. (I haven't actually tested these cases though, this is just based on looking at the code. Writing testcases for this stuff seems like it'd be a pain...) The race leading to state inconsistency is (all operations on the same CPU and kmem_cache): - task A: begin do_slab_free(): - read TID - read pcpu freelist (==NULL) - check `slab == c->slab` (true) - [PREEMPT A->B] - task B: begin slab_alloc_node(): - fastpath fails (`c->freelist` is NULL) - enter __slab_alloc() - slub_get_cpu_ptr() (disables preemption) - enter ___slab_alloc() - take local_lock_irqsave() - read c->freelist as NULL - get_freelist() returns NULL - write `c->slab = NULL` - drop local_unlock_irqrestore() - goto new_slab - slub_percpu_partial() is NULL - get_partial() returns NULL - slub_put_cpu_ptr() (enables preemption) - [PREEMPT B->A] - task A: finish do_slab_free(): - this_cpu_cmpxchg_double() succeeds() - [CORRUPT STATE: c->slab==NULL, c->freelist!=NULL] From there, the object on c->freelist will get lost if task B is allowed to continue from here: It will proceed to the retry_load_slab label, set c->slab, then jump to load_freelist, which clobbers c->freelist. But if we instead continue as follows, we get worse corruption: - task A: run __slab_free() on object from other struct slab: - CPU_PARTIAL_FREE case (slab was on no list, is now on pcpu partial) - task A: run slab_alloc_node() with NUMA node constraint: - fastpath fails (c->slab is NULL) - call __slab_alloc() - slub_get_cpu_ptr() (disables preemption) - enter ___slab_alloc() - c->slab is NULL: goto new_slab - slub_percpu_partial() is non-NULL - set c->slab to slub_percpu_partial(c) - [CORRUPT STATE: c->slab points to slab-1, c->freelist has objects from slab-2] - goto redo - node_match() fails - goto deactivate_slab - existing c->freelist is passed into deactivate_slab() - inuse count of slab-1 is decremented to account for object from slab-2 At this point, the inuse count of slab-1 is 1 lower than it should be. This means that if we free all allocated objects in slab-1 except for one, SLUB will think that slab-1 is completely unused, and may free its page, leading to use-after-free.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在资源管理错误漏洞，该漏洞源于slab分配器在释放CPU slab时未更新TID，可能导致对象丢失或错误释放。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 03e404af26dc2ea0d278d7a342de0aab394793ce ~ 308c6d0e1f200fd26c71270c6e6bfcf0fc6ff082 -
Linux Linux 3.1 -

II. Public POCs for CVE-2022-49700

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2022-49700

请登录查看更多情报信息。

Patches & Fixes for CVE-2022-49700 (8)

Same Patch Batch · Linux · 2025-02-26 · 706 CVEs total

CVE-2022-49201 9.8 CRITICAL ibmvnic: fix race between xmit and reset
CVE-2022-49407 9.8 CRITICAL dlm: fix plock invalid read
CVE-2022-49194 9.8 CRITICAL net: bcmgenet: Use stronger register read/writes to assure ordering
CVE-2022-49093 9.8 CRITICAL skbuff: fix coalescing for page_pool fragment recycling
CVE-2022-49149 9.8 CRITICAL rxrpc: Fix call timer start racing with call destruction
CVE-2022-49094 9.8 CRITICAL net/tls: fix slab-out-of-bounds bug in decrypt_internal
CVE-2022-49362 9.8 CRITICAL NFSD: Fix potential use-after-free in nfsd_file_put()
CVE-2022-49356 9.8 CRITICAL SUNRPC: Trap RDMA segment overflows
CVE-2022-49260 9.8 CRITICAL crypto: hisilicon/sec - fix the aead software fallback for engine
CVE-2022-49418 9.8 CRITICAL NFSv4: Fix free of uninitialized nfs4_label on referral lookup.
CVE-2022-49561 9.8 CRITICAL netfilter: conntrack: re-fetch conntrack after insertion
CVE-2022-49280 9.8 CRITICAL NFSD: prevent underflow in nfssvc_decode_writeargs()
CVE-2022-49058 9.1 CRITICAL cifs: potential buffer overflow in handling symlinks
CVE-2022-49479 8.8 HIGH mt76: fix tx status related use-after-free race on station removal
CVE-2022-49470 8.8 HIGH Bluetooth: btmtksdio: fix use-after-free at btmtksdio_recv_event
CVE-2022-49519 8.8 HIGH ath10k: skip ath10k_halt during suspend for driver state RESTARTING
CVE-2022-49500 8.8 HIGH wl1251: dynamically allocate memory used for DMA
CVE-2022-49328 8.8 HIGH mt76: fix use-after-free by removing a non-RCU wcid pointer
CVE-2022-49535 8.8 HIGH scsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI
CVE-2022-49111 8.8 HIGH Bluetooth: Fix use after free in hci_send_acl

Showing top 20 of 706 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2022-49700

No comments yet

Leave a comment