CVE-2022-48858 in Linux
Summary
by MITRE • 07/16/2024
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: Fix a race on command flush flow
Fix a refcount use after free warning due to a race on command entry. Such race occurs when one of the commands releases its last refcount and frees its index and entry while another process running command flush flow takes refcount to this command entry. The process which handles commands flush may see this command as needed to be flushed if the other process released its refcount but didn't release the index yet. Fix it by adding the needed spin lock.
It fixes the following warning trace:
refcount_t: addition on 0; use-after-free. WARNING: CPU: 11 PID: 540311 at lib/refcount.c:25 refcount_warn_saturate+0x80/0xe0 ... RIP: 0010:refcount_warn_saturate+0x80/0xe0 ... Call Trace: mlx5_cmd_trigger_completions+0x293/0x340 [mlx5_core]
mlx5_cmd_flush+0x3a/0xf0 [mlx5_core]
enter_error_state+0x44/0x80 [mlx5_core]
mlx5_fw_fatal_reporter_err_work+0x37/0xe0 [mlx5_core]
process_one_work+0x1be/0x390 worker_thread+0x4d/0x3d0 ? rescuer_thread+0x350/0x350 kthread+0x141/0x160 ? set_kthread_struct+0x40/0x40 ret_from_fork+0x1f/0x30
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/23/2024
The vulnerability CVE-2022-48858 represents a critical race condition affecting the Linux kernel's mlx5 network driver component, specifically within the command flush flow mechanism. This issue resides in the Mellanox ConnectX family of network interface controllers that utilize the mlx5_core kernel module for device management. The vulnerability stems from improper synchronization mechanisms when handling reference counting operations during command processing, creating a scenario where memory access violations can occur. The flaw manifests when multiple concurrent processes attempt to manage command entries, with one process releasing the final reference count while another process simultaneously executes a command flush operation that attempts to access the same memory location.
The technical root cause involves a classic use-after-free condition that occurs due to insufficient locking mechanisms during concurrent access to command entry structures. When a command completes its processing and releases its last reference count, the system frees both the index and entry memory structures. However, if another process is concurrently executing a command flush flow, it may attempt to acquire a reference to the same command entry before the freeing process has completed all necessary cleanup operations. This creates a temporal window where the flush process accesses memory that has already been freed, leading to the refcount_t addition on 0 warning. The kernel's reference counting mechanism detects this violation and triggers the use-after-free warning, as evidenced by the stack trace showing refcount_warn_saturate being called from lib/refcount.c.
The operational impact of this vulnerability extends beyond simple system instability, potentially enabling attackers to exploit the race condition for privilege escalation or system compromise. The warning trace demonstrates that the issue can trigger kernel oops conditions during normal operation, particularly when the mlx5 firmware reports errors that trigger the command flush mechanism. This vulnerability affects systems running Linux kernels with Mellanox network adapters, potentially impacting data centers, high-performance computing environments, and any infrastructure relying on mlx5-based networking hardware. The race condition can be triggered through normal network operations and firmware error reporting, making it particularly dangerous as it may be exploited without requiring special privileges or specific user interaction.
Mitigation strategies for CVE-2022-48858 focus on implementing proper synchronization mechanisms to prevent concurrent access to command entry structures during reference count modifications. The fix involves adding the necessary spin locks to protect the critical sections where reference counts are incremented or decremented, ensuring that no process can access a command entry that is in the process of being freed. This approach aligns with common security practices for preventing race conditions and follows the principles outlined in CWE-362, which specifically addresses race conditions in concurrent programming. Organizations should prioritize applying kernel updates that include the fix, particularly those addressing the mlx5_core module, and should monitor for any system instability or kernel warnings related to network operations. The solution fundamentally adheres to the ATT&CK technique of privilege escalation through kernel exploitation, as the race condition could theoretically be leveraged to gain elevated system privileges. System administrators should also consider implementing monitoring for kernel warning messages related to reference counting and command processing to detect potential exploitation attempts.