configfs: fix a race in configfs_{,un}register_subsystem() (Linux Linux)

CVE-2022-48931
MEDIUM 4.7

En bref

Source
NVD
EPSS
EPSS 0.17 % · centile 6 ()
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
Linux
Statut NVD
Analyzed

Description

In the Linux kernel, the following vulnerability has been resolved: configfs: fix a race in configfs_{,un}register_subsystem() When configfs_register_subsystem() or configfs_unregister_subsystem() is executing link_group() or unlink_group(), it is possible that two processes add or delete list concurrently. Some unfortunate interleavings of them can cause kernel panic. One of cases is: A --> B --> C --> D A <-- B <-- C <-- D delete list_head *B | delete list_head *C --------------------------------|----------------------------------- configfs_unregister_subsystem | configfs_unregister_subsystem unlink_group | unlink_group unlink_obj | unlink_obj list_del_init | list_del_init __list_del_entry | __list_del_entry __list_del | __list_del // next == C | next->prev = prev | | next->prev = prev prev->next = next | | // prev == B | prev->next = next Fix this by adding mutex when calling link_group() or unlink_group(), but parent configfs_subsystem is NULL when config_item is root. So I create a mutex configfs_subsystem_mutex.

Faiblesses (CWE)

  • CWE-362 — Situation de compétition

Références

Scores

VersionScoreVecteurÉvalué par
CVSS 3.1MEDIUM 4.7CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:HNVD · nvd@nist.gov (Primary)

Références européennes

Avis du CERT-FR

Configurations affectées (CPE NVD)

Produits affectés

ProduitVersions
Linux · Linuxaffected 7063fbf2261194f72ee75afca67b3b38b554b5fa < 40805099af11f68c5ca7dbcfacf455da8f99f622 ; affected 7063fbf2261194f72ee75afca67b3b38b554b5fa < d1654de19d42f513b6cfe955cc77e7f427e05a77 ; affected 7063fbf2261194f72ee75afca67b3b38b554b5fa < a37024f7757c25550accdebf49e497ad6ae239fe ; affected 7063fbf2261194f72ee75afca67b3b38b554b5fa < b7e2b91fcb5c78c414e33dc8d50642e307ca0c5a ; affected 7063fbf2261194f72ee75afca67b3b38b554b5fa < a7ab53d3c27dfe83bb594456b9f38a37796ec39b ; affected 7063fbf2261194f72ee75afca67b3b38b554b5fa < e7a66dd2687758718eddd79b542a95cf3aa488cc
Linux · Linuxaffected 2.6.16 ; unaffected 0 < 2.6.16 ; unaffected 4.9.304 ≤ 4.9.* ; unaffected 4.14.269 ≤ 4.14.* ; unaffected 4.19.232 ≤ 4.19.* ; unaffected 5.4.182 ≤ 5.4.*

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD