{
  "id": "CVE-2022-49270",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2025-02-26T07:01:03.907",
  "lastModified": "2025-02-27T19:15:42.757",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm: fix use-after-free in dm_cleanup_zoned_dev()\n\ndm_cleanup_zoned_dev() uses queue, so it must be called\nbefore blk_cleanup_disk() starts its killing:\n\nblk_cleanup_disk->blk_cleanup_queue()->kobject_put()->blk_release_queue()->\n->...RCU...->blk_free_queue_rcu()->kmem_cache_free()\n\nOtherwise, RCU callback may be executed first and\ndm_cleanup_zoned_dev() will touch free'd memory:\n\n BUG: KASAN: use-after-free in dm_cleanup_zoned_dev+0x33/0xd0\n Read of size 8 at addr ffff88805ac6e430 by task dmsetup/681\n\n CPU: 4 PID: 681 Comm: dmsetup Not tainted 5.17.0-rc2+ #6\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014\n Call Trace:\n  <TASK>\n  dump_stack_lvl+0x57/0x7d\n  print_address_description.constprop.0+0x1f/0x150\n  ? dm_cleanup_zoned_dev+0x33/0xd0\n  kasan_report.cold+0x7f/0x11b\n  ? dm_cleanup_zoned_dev+0x33/0xd0\n  dm_cleanup_zoned_dev+0x33/0xd0\n  __dm_destroy+0x26a/0x400\n  ? dm_blk_ioctl+0x230/0x230\n  ? up_write+0xd8/0x270\n  dev_remove+0x156/0x1d0\n  ctl_ioctl+0x269/0x530\n  ? table_clear+0x140/0x140\n  ? lock_release+0xb2/0x750\n  ? remove_all+0x40/0x40\n  ? rcu_read_lock_sched_held+0x12/0x70\n  ? lock_downgrade+0x3c0/0x3c0\n  ? rcu_read_lock_sched_held+0x12/0x70\n  dm_ctl_ioctl+0xa/0x10\n  __x64_sys_ioctl+0xb9/0xf0\n  do_syscall_64+0x3b/0x90\n  entry_SYSCALL_64_after_hwframe+0x44/0xae\n RIP: 0033:0x7fb6dfa95c27"
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: dm: se corrige el use-after-free en dm_cleanup_zoned_dev() dm_cleanup_zoned_dev() usa cola, por lo que debe llamarse antes de que blk_cleanup_disk() comience su eliminaci\u00f3n: blk_cleanup_disk-&gt;blk_cleanup_queue()-&gt;kobject_put()-&gt;blk_release_queue()-&gt; -&gt;...RCU...-&gt;blk_free_queue_rcu()-&gt;kmem_cache_free() De lo contrario, la devoluci\u00f3n de llamada RCU se puede ejecutar primero y dm_cleanup_zoned_dev() tocar\u00e1 la memoria liberada: ERROR: KASAN: use-after-free en dm_cleanup_zoned_dev+0x33/0xd0 Lectura de tama\u00f1o 8 en la direcci\u00f3n ffff88805ac6e430 por la tarea dmsetup/681 CPU: 4 PID: 681 Comm: dmsetup No contaminado 5.17.0-rc2+ #6 Nombre del hardware: PC est\u00e1ndar QEMU (i440FX + PIIX, 1996), BIOS 1.14.0-2 01/04/2014 Seguimiento de llamadas:  dump_stack_lvl+0x57/0x7d print_address_description.constprop.0+0x1f/0x150 ? dm_cleanup_zoned_dev+0x33/0xd0 kasan_report.cold+0x7f/0x11b ? dm_cleanup_zoned_dev+0x33/0xd0 dm_cleanup_zoned_dev+0x33/0xd0 __dm_destroy+0x26a/0x400 ? dm_blk_ioctl+0x230/0x230 ? up_write+0xd8/0x270 dev_remove+0x156/0x1d0 ctl_ioctl+0x269/0x530 ? table_clear+0x140/0x140 ? lock_release+0xb2/0x750 ? remove_all+0x40/0x40 ? rcu_read_lock_sched_held+0x12/0x70 ? lock_downgrade+0x3c0/0x3c0 ? rcu_read_lock_sched_held+0x12/0x70 dm_ctl_ioctl+0xa/0x10 __x64_sys_ioctl+0xb9/0xf0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7fb6dfa95c27"
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/0987f00a76a17aa7213da492c00ed9e5a6210c73",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/43a043aed964659bc69ef81f266912b73c80d837",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/588b7f5df0cb64f281290c7672470c006abe7160",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/fdfe414ca28ddfd562c233fb27385cf820de03e8",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}