In the Linux kernel, the following vulnerability has been resolved:
scsi: pm8001: Fix use-after-free for aborted TMF sas_task
Currently a use-after-free may occur if a TMF sas_task is aborted before we
handle the IO completion in mpi_ssp_completion(). The abort occurs due to
timeout.
When the timeout occurs, the SAS_TASK_STATE_ABORTED flag is set and the
sas_task is freed in pm8001_exec_internal_tmf_task().
However, if the I/O completion occurs later, the I/O completion still
thinks that the sas_task is available. Fix this by clearing the ccb->task
if the TMF times out - the I/O completion handler does nothing if this
pointer is cleared.
References
Configurations
Configuration 1 (hide)
|
History
07 Aug 2024, 19:41
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Linux
Linux linux Kernel |
|
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | |
| CWE | CWE-416 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
| References | () https://git.kernel.org/stable/c/d872e7b5fe38f325f5206b6872746fa02c2b4819 - Patch | |
| References | () https://git.kernel.org/stable/c/61f162aa4381845acbdc7f2be4dfb694d027c018 - Patch | |
| References | () https://git.kernel.org/stable/c/3c334cdfd94945b8edb94022a0371a8665b17366 - Patch | |
| References | () https://git.kernel.org/stable/c/510b21442c3a2e3ecc071ba3e666b320e7acdd61 - Patch |
16 Jul 2024, 13:43
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-07-16 12:15
Updated : 2024-08-07 19:41
NVD link : CVE-2022-48791
Mitre link : CVE-2022-48791
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-416
Use After Free