In the Linux kernel, the following vulnerability has been resolved:
scsi: pm8001: Fix use-after-free for aborted TMF sas_task
Currently a use-after-free may occur if a TMF sastask is aborted before we handle the IO completion in mpissp_completion(). The abort occurs due to timeout.
When the timeout occurs, the SASTASKSTATEABORTED flag is set and the sastask is freed in pm8001execinternaltmftask().
However, if the I/O completion occurs later, the I/O completion still thinks that the sas_task is available. Fix this by clearing the ccb->task if the TMF times out - the I/O completion handler does nothing if this pointer is cleared.
{ "vanir_signatures": [ { "signature_version": "v1", "digest": { "length": 2040.0, "function_hash": "339333890876987321027202681128403063739" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@510b21442c3a2e3ecc071ba3e666b320e7acdd61", "deprecated": false, "target": { "file": "drivers/scsi/pm8001/pm8001_sas.c", "function": "pm8001_exec_internal_tmf_task" }, "signature_type": "Function", "id": "CVE-2022-48791-17048866" }, { "signature_version": "v1", "digest": { "length": 2040.0, "function_hash": "339333890876987321027202681128403063739" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c334cdfd94945b8edb94022a0371a8665b17366", "deprecated": false, "target": { "file": "drivers/scsi/pm8001/pm8001_sas.c", "function": "pm8001_exec_internal_tmf_task" }, "signature_type": "Function", "id": "CVE-2022-48791-345084be" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "283812231779662943143318447212768084826", "6874669813476480155143800255376803497", "63962650697757150564714089949721390603", "333279875870676811267233976504090230526", "87534565351263837333654407349735693021", "258744424552108670929345223920476529339" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@61f162aa4381845acbdc7f2be4dfb694d027c018", "deprecated": false, "target": { "file": "drivers/scsi/pm8001/pm8001_sas.c" }, "signature_type": "Line", "id": "CVE-2022-48791-3e94dd0f" }, { "signature_version": "v1", "digest": { "length": 2040.0, "function_hash": "339333890876987321027202681128403063739" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@61f162aa4381845acbdc7f2be4dfb694d027c018", "deprecated": false, "target": { "file": "drivers/scsi/pm8001/pm8001_sas.c", "function": "pm8001_exec_internal_tmf_task" }, "signature_type": "Function", "id": "CVE-2022-48791-c0adf6f2" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "283812231779662943143318447212768084826", "6874669813476480155143800255376803497", "63962650697757150564714089949721390603", "333279875870676811267233976504090230526", "87534565351263837333654407349735693021", "258744424552108670929345223920476529339" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c334cdfd94945b8edb94022a0371a8665b17366", "deprecated": false, "target": { "file": "drivers/scsi/pm8001/pm8001_sas.c" }, "signature_type": "Line", "id": "CVE-2022-48791-c2a00115" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "283812231779662943143318447212768084826", "6874669813476480155143800255376803497", "63962650697757150564714089949721390603", "333279875870676811267233976504090230526", "87534565351263837333654407349735693021", "258744424552108670929345223920476529339" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@510b21442c3a2e3ecc071ba3e666b320e7acdd61", "deprecated": false, "target": { "file": "drivers/scsi/pm8001/pm8001_sas.c" }, "signature_type": "Line", "id": "CVE-2022-48791-d83d5959" } ] }