CVE-2022-49935
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2022-49935
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-49935.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2022-49935
- Downstream
- Related
- Published
- 2025-06-18T10:54:36Z
- Modified
- 2025-10-13T21:35:23.995606Z
- Summary
- dma-buf/dma-resv: check if the new fence is really later
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
dma-buf/dma-resv: check if the new fence is really later
Previously when we added a fence to a dma_resv object we always assumed the the newer than all the existing fences.
With Jason's work to add an UAPI to explicit export/import that's not necessary the case any more. So without this check we would allow userspace to force the kernel into an use after free error.
Since the change is very small and defensive it's probably a good idea to backport this to stable kernels as well just in case others are using the dma_resv object in the same way.
- References
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced27836b641c1bf693c96c627388497b4e0f57441bFixedc4c798fe98adceb642050819cb57cbc8f5c27870
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced27836b641c1bf693c96c627388497b4e0f57441bFixeda3f7c10a269d5b77dd5822ade822643ced3057f0
Affected versions
v4.*
v4.19
v4.19-rc7
v4.19-rc8
v4.20
v4.20-rc1
v4.20-rc2
v4.20-rc3
v4.20-rc4
v4.20-rc5
v4.20-rc6
v4.20-rc7
v5.*
v5.0
v5.0-rc1
v5.0-rc2
v5.0-rc3
v5.0-rc4
v5.0-rc5
v5.0-rc6
v5.0-rc7
v5.0-rc8
v5.1
v5.1-rc1
v5.1-rc2
v5.1-rc3
v5.1-rc4
v5.1-rc5
v5.1-rc6
v5.1-rc7
v5.10
v5.10-rc1
v5.10-rc2
v5.10-rc3
v5.10-rc4
v5.10-rc5
v5.10-rc6
v5.10-rc7
v5.11
v5.11-rc1
v5.11-rc2
v5.11-rc3
v5.11-rc4
v5.11-rc5
v5.11-rc6
v5.11-rc7
v5.12
v5.12-rc1
v5.12-rc1-dontuse
v5.12-rc2
v5.12-rc3
v5.12-rc4
v5.12-rc5
v5.12-rc6
v5.12-rc7
v5.12-rc8
v5.13
v5.13-rc1
v5.13-rc2
v5.13-rc3
v5.13-rc4
v5.13-rc5
v5.13-rc6
v5.13-rc7
v5.14
v5.14-rc1
v5.14-rc2
v5.14-rc3
v5.14-rc4
v5.14-rc5
v5.14-rc6
v5.14-rc7
v5.15
v5.15-rc1
v5.15-rc2
v5.15-rc3
v5.15-rc4
v5.15-rc5
v5.15-rc6
v5.15-rc7
v5.16
v5.16-rc1
v5.16-rc2
v5.16-rc3
v5.16-rc4
v5.16-rc5
v5.16-rc6
v5.16-rc7
v5.16-rc8
v5.17
v5.17-rc1
v5.17-rc2
v5.17-rc3
v5.17-rc4
v5.17-rc5
v5.17-rc6
v5.17-rc7
v5.17-rc8
v5.18
v5.18-rc1
v5.18-rc2
v5.18-rc3
v5.18-rc4
v5.18-rc5
v5.18-rc6
v5.18-rc7
v5.19
v5.19-rc1
v5.19-rc2
v5.19-rc3
v5.19-rc4
v5.19-rc5
v5.19-rc6
v5.19-rc7
v5.19-rc8
v5.19.1
v5.19.2
v5.19.3
v5.19.4
v5.19.5
v5.19.6
v5.19.7
v5.2
v5.2-rc1
v5.2-rc2
v5.2-rc3
v5.2-rc4
v5.2-rc5
v5.2-rc6
v5.2-rc7
v5.3
v5.3-rc1
v5.3-rc2
v5.3-rc3
v5.3-rc4
v5.3-rc5
v5.3-rc6
v5.3-rc7
v5.3-rc8
v5.4
v5.4-rc1
v5.4-rc2
v5.4-rc3
v5.4-rc4
v5.4-rc5
v5.4-rc6
v5.4-rc7
v5.4-rc8
v5.5
v5.5-rc1
v5.5-rc2
v5.5-rc3
v5.5-rc4
v5.5-rc5
v5.5-rc6
v5.5-rc7
v5.6
v5.6-rc1
v5.6-rc2
v5.6-rc3
v5.6-rc4
v5.6-rc5
v5.6-rc6
v5.6-rc7
v5.7
v5.7-rc1
v5.7-rc2
v5.7-rc3
v5.7-rc4
v5.7-rc5
v5.7-rc6
v5.7-rc7
v5.8
v5.8-rc1
v5.8-rc2
v5.8-rc3
v5.8-rc4
v5.8-rc5
v5.8-rc6
v5.8-rc7
v5.9
v5.9-rc1
v5.9-rc2
v5.9-rc3
v5.9-rc4
v5.9-rc5
v5.9-rc6
v5.9-rc7
v5.9-rc8
v6.*
v6.0-rc1
Database specific
{
"vanir_signatures": [
{
"signature_type": "Function",
"target": {
"file": "drivers/dma-buf/dma-resv.c",
"function": "dma_resv_add_fence"
},
"signature_version": "v1",
"digest": {
"length": 650.0,
"function_hash": "233632354063497655512511620835558863863"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c4c798fe98adceb642050819cb57cbc8f5c27870",
"deprecated": false,
"id": "CVE-2022-49935-1a28565e"
},
{
"signature_type": "Function",
"target": {
"file": "drivers/dma-buf/dma-resv.c",
"function": "dma_resv_add_fence"
},
"signature_version": "v1",
"digest": {
"length": 650.0,
"function_hash": "233632354063497655512511620835558863863"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a3f7c10a269d5b77dd5822ade822643ced3057f0",
"deprecated": false,
"id": "CVE-2022-49935-7fa7bcee"
},
{
"signature_type": "Line",
"target": {
"file": "drivers/dma-buf/dma-resv.c"
},
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"73230846970825656484708965727913918260",
"122623341068256089486788956737811811274",
"21459809458448836668077379562632044523",
"150408945403448080846211431344223190049"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a3f7c10a269d5b77dd5822ade822643ced3057f0",
"deprecated": false,
"id": "CVE-2022-49935-8b6ce63e"
},
{
"signature_type": "Line",
"target": {
"file": "drivers/dma-buf/dma-resv.c"
},
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"73230846970825656484708965727913918260",
"122623341068256089486788956737811811274",
"21459809458448836668077379562632044523",
"150408945403448080846211431344223190049"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c4c798fe98adceb642050819cb57cbc8f5c27870",
"deprecated": false,
"id": "CVE-2022-49935-dd3e493a"
}
]
}