{ "cveId": "CVE-2022-48954", "url": "https://patchblox.com/security/cve/CVE-2022-48954", "summary": "CVE-2022-48954 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-48954, released October 21, 2024. It is not reported as exploited. Patch Radar priority: High.", "title": "linux: In the Linux kernel, the following vulnerability has been resolved: s390/qeth: fix use-after-free in hsci KASAN fou...", "description": "In the Linux kernel, the following vulnerability has been resolved: s390/qeth: fix use-after-free in hsci KASAN found that addr was dereferenced after br2dev_event_work was freed. ================================================================== BUG: KASAN: use-after-free in qeth_l2_br2dev_worker\u002B0x5ba/0x6b0 Read of size 1 at addr 00000000fdcea440 by task kworker/u760:4/540 CPU: 17 PID: 540 Comm: kworker/u760:4 Tainted: G E 6.1.0-20221128.rc7.git1.5aa3bed4ce83.300.fc36.s390x\u002Bkasan #1 Hardware name: IBM 8561 T01 703 (LPAR) Workqueue: 0.0.8000_event qeth_l2_br2dev_worker Call Trace: [\u003C000000016944d4ce\u003E] dump_stack_lvl\u002B0xc6/0xf8 [\u003C000000016942cd9c\u003E] print_address_description.constprop.0\u002B0x34/0x2a0 [\u003C000000016942d118\u003E] print_report\u002B0x110/0x1f8 [\u003C0000000167a7bd04\u003E] kasan_report\u002B0xfc/0x128 [\u003C000000016938d79a\u003E] qeth_l2_br2dev_worker\u002B0x5ba/0x6b0 [\u003C00000001673edd1e\u003E] process_one_work\u002B0x76e/0x1128 [\u003C00000001673ee85c\u003E] worker_thread\u002B0x184/0x1098 [\u003C000000016740718a\u003E] kthread\u002B0x26a/0x310 [\u003C00000001672c606a\u003E] __ret_from_fork\u002B0x8a/0xe8 [\u003C00000001694711da\u003E] ret_from_fork\u002B0xa/0x40 Allocated by task 108338: kasan_save_stack\u002B0x40/0x68 kasan_set_track\u002B0x36/0x48 __kasan_kmalloc\u002B0xa0/0xc0 qeth_l2_switchdev_event\u002B0x25a/0x738 atomic_notifier_call_chain\u002B0x9c/0xf8 br_switchdev_fdb_notify\u002B0xf4/0x110 fdb_notify\u002B0x122/0x180 fdb_add_entry.constprop.0.isra.0\u002B0x312/0x558 br_fdb_add\u002B0x59e/0x858 rtnl_fdb_add\u002B0x58a/0x928 rtnetlink_rcv_msg\u002B0x5f8/0x8d8 netlink_rcv_skb\u002B0x1f2/0x408 netlink_unicast\u002B0x570/0x790 netlink_sendmsg\u002B0x752/0xbe0 sock_sendmsg\u002B0xca/0x110 ____sys_sendmsg\u002B0x510/0x6a8 ___sys_sendmsg\u002B0x12a/0x180 __sys_sendmsg\u002B0xe6/0x168 __do_sys_socketcall\u002B0x3c8/0x468 do_syscall\u002B0x22c/0x328 __do_syscall\u002B0x94/0xf0 system_call\u002B0x82/0xb0 Freed by task 540: kasan_save_stack\u002B0x40/0x68 kasan_set_track\u002B0x36/0x48 kasan_save_free_info\u002B0x4c/0x68 ____kasan_slab_free\u002B0x14e/0x1a8 __kasan_slab_free\u002B0x24/0x30 __kmem_cache_free\u002B0x168/0x338 qeth_l2_br2dev_worker\u002B0x154/0x6b0 process_one_work\u002B0x76e/0x1128 worker_thread\u002B0x184/0x1098 kthread\u002B0x26a/0x310 __ret_from_fork\u002B0x8a/0xe8 ret_from_fork\u002B0xa/0x40 Last potentially related work creation: kasan_save_stack\u002B0x40/0x68 __kasan_record_aux_stack\u002B0xbe/0xd0 insert_work\u002B0x56/0x2e8 __queue_work\u002B0x4ce/0xd10 queue_work_on\u002B0xf4/0x100 qeth_l2_switchdev_event\u002B0x520/0x738 atomic_notifier_call_chain\u002B0x9c/0xf8 br_switchdev_fdb_notify\u002B0xf4/0x110 fdb_notify\u002B0x122/0x180 fdb_add_entry.constprop.0.isra.0\u002B0x312/0x558 br_fdb_add\u002B0x59e/0x858 rtnl_fdb_add\u002B0x58a/0x928 rtnetlink_rcv_msg\u002B0x5f8/0x8d8 netlink_rcv_skb\u002B0x1f2/0x408 netlink_unicast\u002B0x570/0x790 netlink_sendmsg\u002B0x752/0xbe0 sock_sendmsg\u002B0xca/0x110 ____sys_sendmsg\u002B0x510/0x6a8 ___sys_sendmsg\u002B0x12a/0x180 __sys_sendmsg\u002B0xe6/0x168 __do_sys_socketcall\u002B0x3c8/0x468 do_syscall\u002B0x22c/0x328 __do_syscall\u002B0x94/0xf0 system_call\u002B0x82/0xb0 Second to last potentially related work creation: kasan_save_stack\u002B0x40/0x68 __kasan_record_aux_stack\u002B0xbe/0xd0 kvfree_call_rcu\u002B0xb2/0x760 kernfs_unlink_open_file\u002B0x348/0x430 kernfs_fop_release\u002B0xc2/0x320 __fput\u002B0x1ae/0x768 task_work_run\u002B0x1bc/0x298 exit_to_user_mode_prepare\u002B0x1a0/0x1a8 __do_syscall\u002B0x94/0xf0 system_call\u002B0x82/0xb0 The buggy address belongs to the object at 00000000fdcea400 which belongs to the cache kmalloc-96 of size 96 The buggy address is located 64 bytes inside of 96-byte region [00000000fdcea400, 00000000fdcea460) The buggy address belongs to the physical page: page:000000005a9c26e8 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xfdcea flags: 0x3ffff00000000200(slab|node=0|zone=1|lastcpupid=0x1ffff) raw: 3ffff00000000200 0000000000000000 0000000100000122 000000008008cc00 raw: 0000000000000000 0020004100000000 ffffffff00000001 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: 00000000fdcea300: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc 00000000fdcea380: fb fb fb fb fb fb f ---truncated---", "published": "2024-10-21T20:15:06Z", "severity": "high", "cvss": 7.8, "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "epss": 0.00333, "epssPercentile": 0.26747, "priority": "High", "priorityTier": 3, "exploited": false, "vendorExploited": false, "disclosed": false, "fixes": [ { "platform": "linux", "product": "linux", "release": "Debian 12.15 (bookworm)", "fixedVersion": "6.1.4-1", "fix": "DEBIAN-CVE-2022-48954", "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-48954", "released": "2024-10-21T20:15:06Z" }, { "platform": "linux", "product": "linux", "release": "Debian 13.5 (trixie)", "fixedVersion": "6.1.4-1", "fix": "DEBIAN-CVE-2022-48954", "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-48954", "released": "2024-10-21T20:15:06Z" }, { "platform": "linux", "product": "linux", "release": "Debian 14", "fixedVersion": "6.1.4-1", "fix": "DEBIAN-CVE-2022-48954", "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-48954", "released": "2024-10-21T20:15:06Z" } ], "noFixYet": [], "dataAsOf": "2026-11-08T19:12:23Z", "attribution": { "text": "Data: Patchblox Patch Radar", "url": "https://patchblox.com/security/patch-radar", "terms": "https://patchblox.com/security/patch-radar/use-the-data" } }