In the Linux kernel, the following vulnerability has been resolved:
scsi: target: tcmu: Fix possible page UAF
tcmutrygetdatapage() looks up pages under cmdrlock, but it does not take refcount properly and just returns page pointer. When tcmutrygetdatapage() returns, the returned page may have been freed by tcmublocks_release().
We need to getpage() under cmdrlock to avoid concurrent tcmublocksrelease().
{ "vanir_signatures": [ { "signature_version": "v1", "digest": { "length": 616.0, "function_hash": "109748332314687916438671565355319949559" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a9564d84ed9f6ee71017d062d0d2182154294a4b", "deprecated": false, "target": { "file": "drivers/target/target_core_user.c", "function": "tcmu_vma_fault" }, "signature_type": "Function", "id": "CVE-2022-49053-05d6e578" }, { "signature_version": "v1", "digest": { "length": 616.0, "function_hash": "109748332314687916438671565355319949559" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a6968f7a367f128d120447360734344d5a3d5336", "deprecated": false, "target": { "file": "drivers/target/target_core_user.c", "function": "tcmu_vma_fault" }, "signature_type": "Function", "id": "CVE-2022-49053-1cf45191" }, { "signature_version": "v1", "digest": { "length": 384.0, "function_hash": "334475330983966756191540598547300930380" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fb7a5115422fbd6a4d505e8844f1ef5529f10489", "deprecated": false, "target": { "file": "drivers/target/target_core_user.c", "function": "tcmu_try_get_block_page" }, "signature_type": "Function", "id": "CVE-2022-49053-22336ee7" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "190895031556893358518496131416454587948", "322986966089363117637941602014246043162", "214318767756267377923408931365094627643", "326839945520755390942120869516469802616", "310425471890160790305236264965602592056", "107435720930354071503839975449466592572", "109222161545983608549308070767432468056", "129485047624242873753607541836793671909", "114084972579977914228453268144502284628", "71446799361303327425541354224437045794", "38069712523551822479207272453576938434", "335947811649975223046475103892934070528" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e3e0e067d5b34e4a68e3cc55f8eebc413f56f8ed", "deprecated": false, "target": { "file": "drivers/target/target_core_user.c" }, "signature_type": "Line", "id": "CVE-2022-49053-29fa6bc5" }, { "signature_version": "v1", "digest": { "length": 384.0, "function_hash": "334475330983966756191540598547300930380" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e3e0e067d5b34e4a68e3cc55f8eebc413f56f8ed", "deprecated": false, "target": { "file": "drivers/target/target_core_user.c", "function": "tcmu_try_get_block_page" }, "signature_type": "Function", "id": "CVE-2022-49053-34380ebe" }, { "signature_version": "v1", "digest": { "length": 891.0, "function_hash": "62524965464561842341141929001076635230" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d7c5d79e50be6e06b669141e3db1f977a0dd4e8e", "deprecated": false, "target": { "file": "drivers/target/target_core_user.c", "function": "tcmu_try_get_block_page" }, "signature_type": "Function", "id": "CVE-2022-49053-60babac7" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "229267820023314631686533121676432877434", "302718823649869410651281428846614155994", "254125698140187367987322929545194021011", "326839945520755390942120869516469802616", "310425471890160790305236264965602592056", "107435720930354071503839975449466592572", "307528868952482891215758340992813926859", "222139514692343743418597358544671780751", "114084972579977914228453268144502284628", "71446799361303327425541354224437045794", "38069712523551822479207272453576938434", "335947811649975223046475103892934070528" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b7f3b5d70c834f49f7d87a2f2ed1c6284d9a0322", "deprecated": false, "target": { "file": "drivers/target/target_core_user.c" }, "signature_type": "Line", "id": "CVE-2022-49053-697e0b2e" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "259364716408625446990343411536609709608", "322986966089363117637941602014246043162", "214318767756267377923408931365094627643", "326839945520755390942120869516469802616", "310425471890160790305236264965602592056", "107435720930354071503839975449466592572", "109222161545983608549308070767432468056", "129485047624242873753607541836793671909", "178644161511338088861279969370019565573", "97491892036102475628532055235945688668", "38069712523551822479207272453576938434", "335947811649975223046475103892934070528" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d7c5d79e50be6e06b669141e3db1f977a0dd4e8e", "deprecated": false, "target": { "file": "drivers/target/target_core_user.c" }, "signature_type": "Line", "id": "CVE-2022-49053-6a0b567a" }, { "signature_version": "v1", "digest": { "length": 622.0, "function_hash": "274548616763890085645870184891398784769" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d7c5d79e50be6e06b669141e3db1f977a0dd4e8e", "deprecated": false, "target": { "file": "drivers/target/target_core_user.c", "function": "tcmu_vma_fault" }, "signature_type": "Function", "id": "CVE-2022-49053-6adaac85" }, { "signature_version": "v1", "digest": { "length": 622.0, "function_hash": "174987948351339597816019730354682848812" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e3e0e067d5b34e4a68e3cc55f8eebc413f56f8ed", "deprecated": false, "target": { "file": "drivers/target/target_core_user.c", "function": "tcmu_vma_fault" }, "signature_type": "Function", "id": "CVE-2022-49053-8b4adc20" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "190895031556893358518496131416454587948", "322986966089363117637941602014246043162", "214318767756267377923408931365094627643", "326839945520755390942120869516469802616", "310425471890160790305236264965602592056", "107435720930354071503839975449466592572", "109222161545983608549308070767432468056", "129485047624242873753607541836793671909", "114084972579977914228453268144502284628", "71446799361303327425541354224437045794", "38069712523551822479207272453576938434", "335947811649975223046475103892934070528" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aec36b98a1bbaa84bfd8299a306e4c12314af626", "deprecated": false, "target": { "file": "drivers/target/target_core_user.c" }, "signature_type": "Line", "id": "CVE-2022-49053-9298a1f0" }, { "signature_version": "v1", "digest": { "length": 616.0, "function_hash": "109748332314687916438671565355319949559" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b7f3b5d70c834f49f7d87a2f2ed1c6284d9a0322", "deprecated": false, "target": { "file": "drivers/target/target_core_user.c", "function": "tcmu_vma_fault" }, "signature_type": "Function", "id": "CVE-2022-49053-9d07cf4f" }, { "signature_version": "v1", "digest": { "length": 386.0, "function_hash": "262321729832147330342961451265227922777" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a6968f7a367f128d120447360734344d5a3d5336", "deprecated": false, "target": { "file": "drivers/target/target_core_user.c", "function": "tcmu_try_get_data_page" }, "signature_type": "Function", "id": "CVE-2022-49053-b0330e2c" }, { "signature_version": "v1", "digest": { "length": 622.0, "function_hash": "174987948351339597816019730354682848812" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fb7a5115422fbd6a4d505e8844f1ef5529f10489", "deprecated": false, "target": { "file": "drivers/target/target_core_user.c", "function": "tcmu_vma_fault" }, "signature_type": "Function", "id": "CVE-2022-49053-db9fe0c2" }, { "signature_version": "v1", "digest": { "length": 386.0, "function_hash": "262321729832147330342961451265227922777" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a9564d84ed9f6ee71017d062d0d2182154294a4b", "deprecated": false, "target": { "file": "drivers/target/target_core_user.c", "function": "tcmu_try_get_data_page" }, "signature_type": "Function", "id": "CVE-2022-49053-dfe9a6ad" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "190895031556893358518496131416454587948", "322986966089363117637941602014246043162", "214318767756267377923408931365094627643", "326839945520755390942120869516469802616", "310425471890160790305236264965602592056", "107435720930354071503839975449466592572", "109222161545983608549308070767432468056", "129485047624242873753607541836793671909", "114084972579977914228453268144502284628", "71446799361303327425541354224437045794", "38069712523551822479207272453576938434", "335947811649975223046475103892934070528" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fb7a5115422fbd6a4d505e8844f1ef5529f10489", "deprecated": false, "target": { "file": "drivers/target/target_core_user.c" }, "signature_type": "Line", "id": "CVE-2022-49053-e0df13b3" }, { "signature_version": "v1", "digest": { "length": 384.0, "function_hash": "334475330983966756191540598547300930380" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aec36b98a1bbaa84bfd8299a306e4c12314af626", "deprecated": false, "target": { "file": "drivers/target/target_core_user.c", "function": "tcmu_try_get_block_page" }, "signature_type": "Function", "id": "CVE-2022-49053-e54e3654" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "229267820023314631686533121676432877434", "302718823649869410651281428846614155994", "254125698140187367987322929545194021011", "326839945520755390942120869516469802616", "310425471890160790305236264965602592056", "107435720930354071503839975449466592572", "307528868952482891215758340992813926859", "222139514692343743418597358544671780751", "114084972579977914228453268144502284628", "71446799361303327425541354224437045794", "38069712523551822479207272453576938434", "335947811649975223046475103892934070528" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a9564d84ed9f6ee71017d062d0d2182154294a4b", "deprecated": false, "target": { "file": "drivers/target/target_core_user.c" }, "signature_type": "Line", "id": "CVE-2022-49053-eb38d331" }, { "signature_version": "v1", "digest": { "length": 386.0, "function_hash": "262321729832147330342961451265227922777" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b7f3b5d70c834f49f7d87a2f2ed1c6284d9a0322", "deprecated": false, "target": { "file": "drivers/target/target_core_user.c", "function": "tcmu_try_get_data_page" }, "signature_type": "Function", "id": "CVE-2022-49053-f1f5b746" }, { "signature_version": "v1", "digest": { "length": 622.0, "function_hash": "174987948351339597816019730354682848812" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aec36b98a1bbaa84bfd8299a306e4c12314af626", "deprecated": false, "target": { "file": "drivers/target/target_core_user.c", "function": "tcmu_vma_fault" }, "signature_type": "Function", "id": "CVE-2022-49053-f88edb8c" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "229267820023314631686533121676432877434", "302718823649869410651281428846614155994", "254125698140187367987322929545194021011", "326839945520755390942120869516469802616", "310425471890160790305236264965602592056", "107435720930354071503839975449466592572", "307528868952482891215758340992813926859", "222139514692343743418597358544671780751", "114084972579977914228453268144502284628", "71446799361303327425541354224437045794", "38069712523551822479207272453576938434", "335947811649975223046475103892934070528" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a6968f7a367f128d120447360734344d5a3d5336", "deprecated": false, "target": { "file": "drivers/target/target_core_user.c" }, "signature_type": "Line", "id": "CVE-2022-49053-ffb95f36" } ] }