CVE-2022-48974
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2022-48974
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-48974.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2022-48974
- Downstream
- Published
- 2024-10-21T20:05:54.438Z
- Modified
- 2025-11-28T10:04:37.760998Z
- Summary
- netfilter: conntrack: fix using __this_cpu_add in preemptible
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
netfilter: conntrack: fix using _thiscpu_add in preemptible
Currently in nfconntrackhashcheckinsert(), when it fails in nfctextvalidpre/post(), NFCTSTAT_INC() will be called in the preemptible context, a call trace can be triggered:
BUG: using _thiscpuadd() in preemptible [00000000] code: conntrack/1636 caller is nfconntrackhashcheckinsert+0x45/0x430 [nfconntrack] Call Trace: <TASK> dumpstacklvl+0x33/0x46 checkpreemptiondisabled+0xc3/0xf0 nfconntrackhashcheckinsert+0x45/0x430 [nfconntrack] ctnetlinkcreateconntrack+0x3cd/0x4e0 [nfconntracknetlink] ctnetlinknewconntrack+0x1c0/0x450 [nfconntracknetlink] nfnetlinkrcvmsg+0x277/0x2f0 [nfnetlink] netlinkrcvskb+0x50/0x100 nfnetlinkrcv+0x65/0x144 [nfnetlink] netlinkunicast+0x1ae/0x290 netlinksendmsg+0x257/0x4f0 sock_sendmsg+0x5f/0x70
This patch is to fix it by changing to use NFCTSTATINCATOMIC() for nfctextvalidpre/post() check in nfconntrackhashcheckinsert(), as well as nfctextvalidpost() in _nfconntrack_confirm().
Note that nfctextvalidpre() check in _nfconntrackconfirm() is safe to use NFCTSTATINC(), as it's under localbhdisable().
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48974.json", "cna_assigner": "Linux" }- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/9464d0b68f11a9bc768370c3260ec02b3550447b
- https://git.kernel.org/stable/c/d9bf1138a5db419db13bd9fcd3a7178d6bb20f7c
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48974.json
- https://nvd.nist.gov/vuln/detail/CVE-2022-48974
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedc56716c69ce1ac320432fb1ea5654196ba24d2f8Fixedd9bf1138a5db419db13bd9fcd3a7178d6bb20f7cFixed9464d0b68f11a9bc768370c3260ec02b3550447b
Affected versions
v5.*
v6.*
Database specific
source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-48974.json"
vanir_signatures
[
{
"deprecated": false,
"id": "CVE-2022-48974-807f4637",
"digest": {
"threshold": 0.9,
"line_hashes": [
"205087122119075972413619871527944159144",
"260388553773742432047447777935186283486",
"211477596062111527815333021998992584603",
"301489697950539442004069625298471156315",
"244565089413964922011726629824068216553",
"132945737597713516526004908580179666659",
"168544573678808050142371301880620109606",
"334420910372343090721832766365175978369",
"244565089413964922011726629824068216553",
"228497294916941873564061551904508868708",
"108656135348886423967735854760858577094",
"135063107420739852146402469288294254805"
]
},
"signature_version": "v1",
"target": {
"file": "net/netfilter/nf_conntrack_core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d9bf1138a5db419db13bd9fcd3a7178d6bb20f7c",
"signature_type": "Line"
},
{
"deprecated": false,
"id": "CVE-2022-48974-fcd295e6",
"digest": {
"threshold": 0.9,
"line_hashes": [
"205087122119075972413619871527944159144",
"260388553773742432047447777935186283486",
"211477596062111527815333021998992584603",
"301489697950539442004069625298471156315",
"244565089413964922011726629824068216553",
"132945737597713516526004908580179666659",
"168544573678808050142371301880620109606",
"334420910372343090721832766365175978369",
"244565089413964922011726629824068216553",
"228497294916941873564061551904508868708",
"108656135348886423967735854760858577094",
"135063107420739852146402469288294254805"
]
},
"signature_version": "v1",
"target": {
"file": "net/netfilter/nf_conntrack_core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9464d0b68f11a9bc768370c3260ec02b3550447b",
"signature_type": "Line"
}
]