{
  "cveId": "CVE-2022-48842",
  "url": "https://patchblox.com/security/cve/CVE-2022-48842",
  "summary": "CVE-2022-48842 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-48842, released July 16, 2024. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  ice: Fix race condition during interface enslave...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  ice: Fix race condition during interface enslave  Commit 5dbbbd01cbba83 (\u0022ice: Avoid RTNL lock when re-creating auxiliary device\u0022) changes a process of re-creation of aux device so ice_plug_aux_dev() is called from ice_service_task() context. This unfortunately opens a race window that can result in dead-lock when interface has left LAG and immediately enters LAG again.  Reproducer: \u0060\u0060\u0060 #!/bin/sh  ip link add lag0 type bond mode 1 miimon 100 ip link set lag0  for n in {1..10}; do         echo Cycle: $n         ip link set ens7f0 master lag0         sleep 1         ip link set ens7f0 nomaster done \u0060\u0060\u0060  This results in: [20976.208697] Workqueue: ice ice_service_task [ice] [20976.213422] Call Trace: [20976.215871]  __schedule\u002B0x2d1/0x830 [20976.219364]  schedule\u002B0x35/0xa0 [20976.222510]  schedule_preempt_disabled\u002B0xa/0x10 [20976.227043]  __mutex_lock.isra.7\u002B0x310/0x420 [20976.235071]  enum_all_gids_of_dev_cb\u002B0x1c/0x100 [ib_core] [20976.251215]  ib_enum_roce_netdev\u002B0xa4/0xe0 [ib_core] [20976.256192]  ib_cache_setup_one\u002B0x33/0xa0 [ib_core] [20976.261079]  ib_register_device\u002B0x40d/0x580 [ib_core] [20976.266139]  irdma_ib_register_device\u002B0x129/0x250 [irdma] [20976.281409]  irdma_probe\u002B0x2c1/0x360 [irdma] [20976.285691]  auxiliary_bus_probe\u002B0x45/0x70 [20976.289790]  really_probe\u002B0x1f2/0x480 [20976.298509]  driver_probe_device\u002B0x49/0xc0 [20976.302609]  bus_for_each_drv\u002B0x79/0xc0 [20976.306448]  __device_attach\u002B0xdc/0x160 [20976.310286]  bus_probe_device\u002B0x9d/0xb0 [20976.314128]  device_add\u002B0x43c/0x890 [20976.321287]  __auxiliary_device_add\u002B0x43/0x60 [20976.325644]  ice_plug_aux_dev\u002B0xb2/0x100 [ice] [20976.330109]  ice_service_task\u002B0xd0c/0xed0 [ice] [20976.342591]  process_one_work\u002B0x1a7/0x360 [20976.350536]  worker_thread\u002B0x30/0x390 [20976.358128]  kthread\u002B0x10a/0x120 [20976.365547]  ret_from_fork\u002B0x1f/0x40 ... [20976.438030] task:ip              state:D stack:    0 pid:213658 ppid:213627 flags:0x00004084 [20976.446469] Call Trace: [20976.448921]  __schedule\u002B0x2d1/0x830 [20976.452414]  schedule\u002B0x35/0xa0 [20976.455559]  schedule_preempt_disabled\u002B0xa/0x10 [20976.460090]  __mutex_lock.isra.7\u002B0x310/0x420 [20976.464364]  device_del\u002B0x36/0x3c0 [20976.467772]  ice_unplug_aux_dev\u002B0x1a/0x40 [ice] [20976.472313]  ice_lag_event_handler\u002B0x2a2/0x520 [ice] [20976.477288]  notifier_call_chain\u002B0x47/0x70 [20976.481386]  __netdev_upper_dev_link\u002B0x18b/0x280 [20976.489845]  bond_enslave\u002B0xe05/0x1790 [bonding] [20976.494475]  do_setlink\u002B0x336/0xf50 [20976.502517]  __rtnl_newlink\u002B0x529/0x8b0 [20976.543441]  rtnl_newlink\u002B0x43/0x60 [20976.546934]  rtnetlink_rcv_msg\u002B0x2b1/0x360 [20976.559238]  netlink_rcv_skb\u002B0x4c/0x120 [20976.563079]  netlink_unicast\u002B0x196/0x230 [20976.567005]  netlink_sendmsg\u002B0x204/0x3d0 [20976.570930]  sock_sendmsg\u002B0x4c/0x50 [20976.574423]  ____sys_sendmsg\u002B0x1eb/0x250 [20976.586807]  ___sys_sendmsg\u002B0x7c/0xc0 [20976.606353]  __sys_sendmsg\u002B0x57/0xa0 [20976.609930]  do_syscall_64\u002B0x5b/0x1a0 [20976.613598]  entry_SYSCALL_64_after_hwframe\u002B0x65/0xca  1. Command \u0027ip link ... set nomaster\u0027 causes that ice_plug_aux_dev()    is called from ice_service_task() context, aux device is created    and associated device-\u003Elock is taken. 2. Command \u0027ip link ... set master...\u0027 calls ice\u0027s notifier under    RTNL lock and that notifier calls ice_unplug_aux_dev(). That    function tries to take aux device-\u003Elock but this is already taken    by ice_plug_aux_dev() in step 1 3. Later ice_plug_aux_dev() tries to take RTNL lock but this is already    taken in step 2 4. Dead-lock  The patch fixes this issue by following changes: - Bit ICE_FLAG_PLUG_AUX_DEV is kept to be set during ice_plug_aux_dev()   call in ice_service_task() - The bit is checked in ice_clear_rdma_cap() and only if it is not set   then ice_unplug_aux_dev() is called. If it is set (in other words   plugging of aux device was requested and ice_plug_aux_dev() is   potentially running) then the function only clears the ---truncated---",
  "published": "2024-07-16T13:15:11Z",
  "severity": "medium",
  "cvss": 4.7,
  "cvssVector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.00183,
  "epssPercentile": 0.07951,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "5.16.18-1",
      "fix": "DEBIAN-CVE-2022-48842",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-48842",
      "released": "2024-07-16T13:15:11Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "5.16.18-1",
      "fix": "DEBIAN-CVE-2022-48842",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-48842",
      "released": "2024-07-16T13:15:11Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "5.16.18-1",
      "fix": "DEBIAN-CVE-2022-48842",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-48842",
      "released": "2024-07-16T13:15:11Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}