180 lines
10 KiB
JSON
180 lines
10 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.2",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2022-49160",
|
||
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "Linux",
|
||
"dateReserved": "2025-02-26T01:49:39.276Z",
|
||
"datePublished": "2025-02-26T01:55:22.562Z",
|
||
"dateUpdated": "2026-08-05T08:54:08.041Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"providerMetadata": {
|
||
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||
"shortName": "Linux",
|
||
"dateUpdated": "2026-08-05T08:54:08.041Z"
|
||
},
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix crash during module load unload test\n\nDuring purex packet handling the driver was incorrectly freeing a\npre-allocated structure. Fix this by skipping that entry.\n\nSystem crashed with the following stack during a module unload test.\n\nCall Trace:\n\tsbitmap_init_node+0x7f/0x1e0\n\tsbitmap_queue_init_node+0x24/0x150\n\tblk_mq_init_bitmaps+0x3d/0xa0\n\tblk_mq_init_tags+0x68/0x90\n\tblk_mq_alloc_map_and_rqs+0x44/0x120\n\tblk_mq_alloc_set_map_and_rqs+0x63/0x150\n\tblk_mq_alloc_tag_set+0x11b/0x230\n\tscsi_add_host_with_dma.cold+0x3f/0x245\n\tqla2x00_probe_one+0xd5a/0x1b80 [qla2xxx]\n\nCall Trace with slub_debug and debug kernel:\n\tkasan_report_invalid_free+0x50/0x80\n\t__kasan_slab_free+0x137/0x150\n\tslab_free_freelist_hook+0xc6/0x190\n\tkfree+0xe8/0x2e0\n\tqla2x00_free_device+0x3bb/0x5d0 [qla2xxx]\n\tqla2x00_remove_one+0x668/0xcf0 [qla2xxx]"
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"version": "3.1",
|
||
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||
"baseScore": 7.5,
|
||
"baseSeverity": "HIGH"
|
||
},
|
||
"scenarios": [
|
||
{
|
||
"lang": "en",
|
||
"value": "AV:A - qla2xxx is a Fibre Channel HBA driver; the poisoned purex_list entry is created when the ISR receives Purex ELS/ABTS/FPIN from a SAN peer (qla24xx_copy_std_pkt → default_item) and queues it. FC is a non-routable fabric, so Adjacent is the highest defensible vector.\nAC:H - A fabric peer can reliably arm the bug by sending Purex/ABTS so default_item stays on purex_list (especially when LOOP_READY is false or UNLOADING prevents DPC drain), but the invalid kfree only runs in qla24xx_free_purex_list during qla2x00_free_device, which requires device/module removal beyond the fabric attacker’s control.\nPR:N - Purex/ABTS/FPIN delivery and queuing are driven by unauthenticated FC frames from a fabric peer in the host driver’s ISR path, with no Linux credentials or capabilities required on the victim host.\nUI:N - No victim user action such as mounting a filesystem or opening a device is required; fabric peers emit ELS/ABTS in normal SAN operation, and teardown that frees the list occurs during routine driver remove without interactive user content handling.\nS:U - Impact remains within the host kernel authority that owns the qla2xxx driver (slab freelist corruption and crash); this is not a VM escape, IOMMU bypass, or other cross-boundary scope change.\nC:H - kfree of the embedded default_item (mid-object pointer inside scsi_host private data) is an invalid free that corrupts the slab freelist, which can be leveraged for arbitrary kernel memory disclosure via heap reuse.\nI:H - The same invalid-free slab corruption enables heap spraying and control-flow/integrity compromise once the corrupted freelist is reused, as evidenced by subsequent allocation crashes during reprobe after unload.\nA:H - KASAN reports invalid free in qla2x00_free_device and the system oopses/panics on later allocations (e.g. blk_mq during qla2x00_probe_one), which is a full kernel availability loss."
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"affected": [
|
||
{
|
||
"product": "Linux",
|
||
"vendor": "Linux",
|
||
"defaultStatus": "unaffected",
|
||
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
||
"programFiles": [
|
||
"drivers/scsi/qla2xxx/qla_os.c"
|
||
],
|
||
"versions": [
|
||
{
|
||
"version": "62e9dd177732843ae6c5b9d2ed61e7c9538fa276",
|
||
"lessThan": "9b7eb92dac240ab3bc83e188d83a3df834b41eb2",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "62e9dd177732843ae6c5b9d2ed61e7c9538fa276",
|
||
"lessThan": "213e57b42537f1a2e5395caa9d7189854133ed12",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "62e9dd177732843ae6c5b9d2ed61e7c9538fa276",
|
||
"lessThan": "67f744f73eba870ab96411d0310e831a4adc3713",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "62e9dd177732843ae6c5b9d2ed61e7c9538fa276",
|
||
"lessThan": "0972252450f90db56dd5415a20e2aec21a08d036",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"product": "Linux",
|
||
"vendor": "Linux",
|
||
"defaultStatus": "affected",
|
||
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
||
"programFiles": [
|
||
"drivers/scsi/qla2xxx/qla_os.c"
|
||
],
|
||
"versions": [
|
||
{
|
||
"version": "5.9",
|
||
"status": "affected"
|
||
},
|
||
{
|
||
"version": "0",
|
||
"lessThan": "5.9",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.15.54",
|
||
"lessThanOrEqual": "5.15.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.16.19",
|
||
"lessThanOrEqual": "5.16.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.17.2",
|
||
"lessThanOrEqual": "5.17.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.18",
|
||
"lessThanOrEqual": "*",
|
||
"status": "unaffected",
|
||
"versionType": "original_commit_for_fix"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"cpeApplicability": [
|
||
{
|
||
"nodes": [
|
||
{
|
||
"operator": "OR",
|
||
"negate": false,
|
||
"cpeMatch": [
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "5.9",
|
||
"versionEndExcluding": "5.15.54"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "5.9",
|
||
"versionEndExcluding": "5.16.19"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "5.9",
|
||
"versionEndExcluding": "5.17.2"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "5.9",
|
||
"versionEndExcluding": "5.18"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"references": [
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/9b7eb92dac240ab3bc83e188d83a3df834b41eb2"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/213e57b42537f1a2e5395caa9d7189854133ed12"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/67f744f73eba870ab96411d0310e831a4adc3713"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/0972252450f90db56dd5415a20e2aec21a08d036"
|
||
}
|
||
],
|
||
"title": "scsi: qla2xxx: Fix crash during module load unload test",
|
||
"x_generator": {
|
||
"engine": "bippy-1.2.0"
|
||
}
|
||
}
|
||
}
|
||
} |