263 lines
14 KiB
JSON
263 lines
14 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.2",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2022-49670",
|
||
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "Linux",
|
||
"dateReserved": "2025-02-26T02:21:30.436Z",
|
||
"datePublished": "2025-02-26T02:24:03.938Z",
|
||
"dateUpdated": "2026-08-05T08:56:00.433Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"providerMetadata": {
|
||
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||
"shortName": "Linux",
|
||
"dateUpdated": "2026-08-05T08:56:00.433Z"
|
||
},
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlinux/dim: Fix divide by 0 in RDMA DIM\n\nFix a divide 0 error in rdma_dim_stats_compare() when prev->cpe_ratio ==\n0.\n\nCallTrace:\n Hardware name: H3C R4900 G3/RS33M2C9S, BIOS 2.00.37P21 03/12/2020\n task: ffff880194b78000 task.stack: ffffc90006714000\n RIP: 0010:backport_rdma_dim+0x10e/0x240 [mlx_compat]\n RSP: 0018:ffff880c10e83ec0 EFLAGS: 00010202\n RAX: 0000000000002710 RBX: ffff88096cd7f780 RCX: 0000000000000064\n RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000001\n RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000000000 R12: 000000001d7c6c09\n R13: ffff88096cd7f780 R14: ffff880b174fe800 R15: 0000000000000000\n FS: 0000000000000000(0000) GS:ffff880c10e80000(0000)\n knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00000000a0965b00 CR3: 000000000200a003 CR4: 00000000007606e0\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n PKRU: 55555554\n Call Trace:\n <IRQ>\n ib_poll_handler+0x43/0x80 [ib_core]\n irq_poll_softirq+0xae/0x110\n __do_softirq+0xd1/0x28c\n irq_exit+0xde/0xf0\n do_IRQ+0x54/0xe0\n common_interrupt+0x8f/0x8f\n </IRQ>\n ? cpuidle_enter_state+0xd9/0x2a0\n ? cpuidle_enter_state+0xc7/0x2a0\n ? do_idle+0x170/0x1d0\n ? cpu_startup_entry+0x6f/0x80\n ? start_secondary+0x1b9/0x210\n ? secondary_startup_64+0xa5/0xb0\n Code: 0f 87 e1 00 00 00 8b 4c 24 14 44 8b 43 14 89 c8 4d 63 c8 44 29 c0 99 31 d0 29 d0 31 d2 48 98 48 8d 04 80 48 8d 04 80 48 c1 e0 02 <49> f7 f1 48 83 f8 0a 0f 86 c1 00 00 00 44 39 c1 7f 10 48 89 df\n RIP: backport_rdma_dim+0x10e/0x240 [mlx_compat] RSP: ffff880c10e83ec0"
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"version": "3.1",
|
||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
||
"baseScore": 7.5,
|
||
"baseSeverity": "HIGH"
|
||
},
|
||
"scenarios": [
|
||
{
|
||
"lang": "en",
|
||
"value": "AV:N - The vulnerable rdma_dim() path runs while processing in-kernel CQ completions for RDMA ULPs such as ksmbd SMB Direct, NFS/RDMA (svcrdma), and NVMe-oF RDMA, which accept remote peers over RoCE/iWARP (layer-3+). A remote client’s RDMA traffic drives ib_poll_handler/ib_cq_poll_work into the buggy stats compare.\nAC:L - The attacker controls connection rate and completion volume; under load, sample windows can yield prev->cpe_ratio==0 (including via delta_us==0 leaving uninitialized stats that are then stored), so the divide-by-zero is reliably inducible without relying on victim-side chance.\nPR:N - Kernel CQs with DIM are created at RDMA CM accept for these servers, and completions are processed before application-level authentication (SMB session, NFS export auth, NVMe auth), so an unauthenticated network peer can reach the code.\nUI:N - No victim user action is required; connecting and generating RDMA completions against an exposed RDMA service is sufficient.\nS:U - A kernel oops/panic affects only the local kernel’s availability authority; there is no VM/IOMMU/sandbox boundary crossing.\nC:N - This is a pure arithmetic divide-by-zero exception with no memory read, leak, or corruption primitive.\nI:N - There is no out-of-bounds write, UAF, or other memory corruption that could alter data or hijack control flow—only a crash.\nA:H - Division by zero in softirq/workqueue CQ polling oopses the kernel (as in the reported call trace) and can panic the host, fully denying availability."
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"affected": [
|
||
{
|
||
"product": "Linux",
|
||
"vendor": "Linux",
|
||
"defaultStatus": "unaffected",
|
||
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
||
"programFiles": [
|
||
"include/linux/dim.h"
|
||
],
|
||
"versions": [
|
||
{
|
||
"version": "f4915455dcf07c4f237d6160a4b6adb0575d2909",
|
||
"lessThan": "5af106f8e072aebd88b95e164a08fa320651a99a",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "f4915455dcf07c4f237d6160a4b6adb0575d2909",
|
||
"lessThan": "fae2a9fb1eaf348ad8732f90d42ebbb971bd7e95",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "f4915455dcf07c4f237d6160a4b6adb0575d2909",
|
||
"lessThan": "0b6e0eb5c45e79e9095de2498cc0ca5ec563fc5e",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "f4915455dcf07c4f237d6160a4b6adb0575d2909",
|
||
"lessThan": "7c1963391af51ee322378d1b2849c60e9037f069",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "f4915455dcf07c4f237d6160a4b6adb0575d2909",
|
||
"lessThan": "0fe3dbbefb74a8575f61d7801b08dbc50523d60d",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"product": "Linux",
|
||
"vendor": "Linux",
|
||
"defaultStatus": "affected",
|
||
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
||
"programFiles": [
|
||
"include/linux/dim.h"
|
||
],
|
||
"versions": [
|
||
{
|
||
"version": "5.3",
|
||
"status": "affected"
|
||
},
|
||
{
|
||
"version": "0",
|
||
"lessThan": "5.3",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.4.204",
|
||
"lessThanOrEqual": "5.4.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.10.129",
|
||
"lessThanOrEqual": "5.10.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.15.53",
|
||
"lessThanOrEqual": "5.15.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.18.10",
|
||
"lessThanOrEqual": "5.18.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.19",
|
||
"lessThanOrEqual": "*",
|
||
"status": "unaffected",
|
||
"versionType": "original_commit_for_fix"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"cpeApplicability": [
|
||
{
|
||
"nodes": [
|
||
{
|
||
"operator": "OR",
|
||
"negate": false,
|
||
"cpeMatch": [
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "5.3",
|
||
"versionEndExcluding": "5.4.204"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "5.3",
|
||
"versionEndExcluding": "5.10.129"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "5.3",
|
||
"versionEndExcluding": "5.15.53"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "5.3",
|
||
"versionEndExcluding": "5.18.10"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "5.3",
|
||
"versionEndExcluding": "5.19"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"references": [
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/5af106f8e072aebd88b95e164a08fa320651a99a"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/fae2a9fb1eaf348ad8732f90d42ebbb971bd7e95"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/0b6e0eb5c45e79e9095de2498cc0ca5ec563fc5e"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/7c1963391af51ee322378d1b2849c60e9037f069"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/0fe3dbbefb74a8575f61d7801b08dbc50523d60d"
|
||
}
|
||
],
|
||
"title": "linux/dim: Fix divide by 0 in RDMA DIM",
|
||
"x_generator": {
|
||
"engine": "bippy-1.2.0"
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"scope": "UNCHANGED",
|
||
"version": "3.1",
|
||
"baseScore": 5.5,
|
||
"attackVector": "LOCAL",
|
||
"baseSeverity": "MEDIUM",
|
||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
|
||
"integrityImpact": "NONE",
|
||
"userInteraction": "NONE",
|
||
"attackComplexity": "LOW",
|
||
"availabilityImpact": "HIGH",
|
||
"privilegesRequired": "LOW",
|
||
"confidentialityImpact": "NONE"
|
||
}
|
||
},
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"id": "CVE-2022-49670",
|
||
"role": "CISA Coordinator",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "no"
|
||
},
|
||
{
|
||
"Technical Impact": "partial"
|
||
}
|
||
],
|
||
"version": "2.0.3",
|
||
"timestamp": "2025-10-01T19:33:21.787883Z"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"type": "CWE",
|
||
"cweId": "CWE-369",
|
||
"description": "CWE-369 Divide By Zero"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2025-10-01T19:36:47.592Z"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
} |