Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2022-49076

RDMA/hfi1: Fix use-after-free bug for mm struct

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Fix use-after-free bug for mm struct Under certain conditions, such as MPI_Abort, the hfi1 cleanup code may represent the last reference held on the task mm. hfi1_mmu_rb_unregister() then drops the last reference and the mm is freed before the final use in hfi1_release_user_pages(). A new task may allocate the mm structure while it is still being used, resulting in problems. One manifestation is corruption of the mmap_sem counter leading to a hang in down_write(). Another is corruption of an mm struct that is in use by another task.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 3d2a9d642512c21a12d19b9250e7a835dcb41a79 to < 5f54364ff6cfcd14cddf5441c4a490bb28dd69f7affected
  • 3d2a9d642512c21a12d19b9250e7a835dcb41a79 to < 9ca11bd8222a612de0d2f54d050bfcf61ae2883faffected
  • 3d2a9d642512c21a12d19b9250e7a835dcb41a79 to < 0b7186d657ee55e2cdefae498f07d5c1961e8023affected
  • 3d2a9d642512c21a12d19b9250e7a835dcb41a79 to < 5a9a1b24ddb510715f8f621263938186579a965caffected
  • 3d2a9d642512c21a12d19b9250e7a835dcb41a79 to < 2bbac98d0930e8161b1957dc0ec99de39ade1b3caffected
  • 5732f83596f8a573f2cde814cc76a54e1a8995c7affected
  • 5.9.12 to < 5.10affected

Linux Linux

Default version status: affected

  • 5.10affected
  • 0 to < 5.10unaffected
  • 5.10.111 to ≤ 5.10.*unaffected
  • 5.15.34 to ≤ 5.15.*unaffected
  • 5.16.20 to ≤ 5.16.*unaffected
  • 5.17.3 to ≤ 5.17.*unaffected
  • 5.18 to ≤ *unaffected

References