CVE-2022-48671

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-48671
In the Linux kernel, the following vulnerability has been resolved: cgroup: Add missing cpus_read_lock() to cgroup_attach_task_all() syzbot is hitting percpu_rwsem_assert_held(&cpu_hotplug_lock) warning at cpuset_attach() [1], for commit 4f7e7236435ca0ab ("cgroup: Fix threadgroup_rwsem <-> cpus_read_lock() deadlock") missed that cpuset_attach() is also called from cgroup_attach_task_all(). Add cpus_read_lock() like what cgroup_procs_write_start() does.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/07191f984842d50020789ff14c75da436a7f46a9 Patch
https://git.kernel.org/stable/c/321488cfac7d0eb6d97de467015ff754f85813ff Patch
https://git.kernel.org/stable/c/43626dade36fa74d3329046f4ae2d7fdefe401c6 Patch
https://git.kernel.org/stable/c/5db17805b6ba4c34dab303f49aea3562fc25af75 Patch
https://git.kernel.org/stable/c/99bc25748e394d17f9e8b10cc7f273b8e64c1c7e Patch
https://git.kernel.org/stable/c/9f267393b036f1470fb12fb892d59e7ff8aeb58d Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

23 May 2024, 20:26

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
References () https://git.kernel.org/stable/c/07191f984842d50020789ff14c75da436a7f46a9 - () https://git.kernel.org/stable/c/07191f984842d50020789ff14c75da436a7f46a9 - Patch
References () https://git.kernel.org/stable/c/321488cfac7d0eb6d97de467015ff754f85813ff - () https://git.kernel.org/stable/c/321488cfac7d0eb6d97de467015ff754f85813ff - Patch
References () https://git.kernel.org/stable/c/43626dade36fa74d3329046f4ae2d7fdefe401c6 - () https://git.kernel.org/stable/c/43626dade36fa74d3329046f4ae2d7fdefe401c6 - Patch
References () https://git.kernel.org/stable/c/5db17805b6ba4c34dab303f49aea3562fc25af75 - () https://git.kernel.org/stable/c/5db17805b6ba4c34dab303f49aea3562fc25af75 - Patch
References () https://git.kernel.org/stable/c/99bc25748e394d17f9e8b10cc7f273b8e64c1c7e - () https://git.kernel.org/stable/c/99bc25748e394d17f9e8b10cc7f273b8e64c1c7e - Patch
References () https://git.kernel.org/stable/c/9f267393b036f1470fb12fb892d59e7ff8aeb58d - () https://git.kernel.org/stable/c/9f267393b036f1470fb12fb892d59e7ff8aeb58d - Patch
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: cgroup: agregue cpus_read_lock() faltante a cgroup_attach_task_all() syzbot está presionando la advertencia percpu_rwsem_assert_held(&amp;cpu_hotplug_lock) en cpuset_attach() [1], para el commit 4f7e7236435ca0ab ("cgroup: Fix threadgroup_rwsem &lt;- &gt; cpus_read_lock() deadlock") se perdió que cpuset_attach() también se llama desde cgroup_attach_task_all(). Agregue cpus_read_lock() como lo hace cgroup_procs_write_start().
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
First Time Linux linux Kernel
Linux
CWE CWE-667

03 May 2024, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-03 15:15

Updated : 2024-11-20 15:35

NVD link : CVE-2022-48671

Mitre link : CVE-2022-48671

CVE.ORG link : CVE-2022-48671

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-667

Improper Locking