In the Linux kernel, the following vulnerability has been resolved:
IB/rdmavt: add lock to call to rvterrorqp to prevent a race condition
The documentation of the function rvterrorqp says both rlock and slock need to be held when calling that function. It also asserts using lockdep that both of those locks are held. However, the commit I referenced in Fixes accidentally makes the call to rvterrorqp in rvtrucloopback no longer covered by r_lock. This results in the lockdep assertion failing and also possibly in a race condition.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49089.json"
}[
{
"signature_version": "v1",
"digest": {
"line_hashes": [
"200601647764106898972618751068650505358",
"140827858050469878012785372279460610251",
"263306727658362157579217428299001308910",
"129327742356086918582485498304176402866"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "drivers/infiniband/sw/rdmavt/qp.c"
},
"signature_type": "Line",
"id": "CVE-2022-49089-0a096674",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@57800cc36e55db0547461c49acf5cd84c0f502b0"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "338713871650893470591671066017522030729",
"length": 7407.0
},
"deprecated": false,
"target": {
"function": "rvt_ruc_loopback",
"file": "drivers/infiniband/sw/rdmavt/qp.c"
},
"signature_type": "Function",
"id": "CVE-2022-49089-17482447",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4d809f69695d4e7d1378b3a072fa9aef23123018"
},
{
"signature_version": "v1",
"digest": {
"line_hashes": [
"200601647764106898972618751068650505358",
"140827858050469878012785372279460610251",
"263306727658362157579217428299001308910",
"129327742356086918582485498304176402866"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "drivers/infiniband/sw/rdmavt/qp.c"
},
"signature_type": "Line",
"id": "CVE-2022-49089-2e2a715d",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@92f1947c0d26060e978b3a9f21f32ce7c8c9cca3"
},
{
"signature_version": "v1",
"digest": {
"line_hashes": [
"200601647764106898972618751068650505358",
"140827858050469878012785372279460610251",
"263306727658362157579217428299001308910",
"129327742356086918582485498304176402866"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "drivers/infiniband/sw/rdmavt/qp.c"
},
"signature_type": "Line",
"id": "CVE-2022-49089-3362a0f0",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@77ffb2495a41098f9d6a14f8aefde3188da75944"
},
{
"signature_version": "v1",
"digest": {
"line_hashes": [
"200601647764106898972618751068650505358",
"140827858050469878012785372279460610251",
"263306727658362157579217428299001308910",
"129327742356086918582485498304176402866"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "drivers/infiniband/sw/rdmavt/qp.c"
},
"signature_type": "Line",
"id": "CVE-2022-49089-4d857dc9",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8a50937227c385a477177c9ffa122b4230e40666"
},
{
"signature_version": "v1",
"digest": {
"line_hashes": [
"200601647764106898972618751068650505358",
"140827858050469878012785372279460610251",
"263306727658362157579217428299001308910",
"129327742356086918582485498304176402866"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "drivers/infiniband/sw/rdmavt/qp.c"
},
"signature_type": "Line",
"id": "CVE-2022-49089-5912b84b",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4d809f69695d4e7d1378b3a072fa9aef23123018"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "338713871650893470591671066017522030729",
"length": 7407.0
},
"deprecated": false,
"target": {
"function": "rvt_ruc_loopback",
"file": "drivers/infiniband/sw/rdmavt/qp.c"
},
"signature_type": "Function",
"id": "CVE-2022-49089-911f96cb",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@43c2d7890ecabe527448a6c391fb2d9a5e6bbfe0"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "338713871650893470591671066017522030729",
"length": 7407.0
},
"deprecated": false,
"target": {
"function": "rvt_ruc_loopback",
"file": "drivers/infiniband/sw/rdmavt/qp.c"
},
"signature_type": "Function",
"id": "CVE-2022-49089-b8e1f549",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@77ffb2495a41098f9d6a14f8aefde3188da75944"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "338713871650893470591671066017522030729",
"length": 7407.0
},
"deprecated": false,
"target": {
"function": "rvt_ruc_loopback",
"file": "drivers/infiniband/sw/rdmavt/qp.c"
},
"signature_type": "Function",
"id": "CVE-2022-49089-d280a66e",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8a50937227c385a477177c9ffa122b4230e40666"
},
{
"signature_version": "v1",
"digest": {
"line_hashes": [
"200601647764106898972618751068650505358",
"140827858050469878012785372279460610251",
"263306727658362157579217428299001308910",
"129327742356086918582485498304176402866"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "drivers/infiniband/sw/rdmavt/qp.c"
},
"signature_type": "Line",
"id": "CVE-2022-49089-e04c18d1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@43c2d7890ecabe527448a6c391fb2d9a5e6bbfe0"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "338713871650893470591671066017522030729",
"length": 7407.0
},
"deprecated": false,
"target": {
"function": "rvt_ruc_loopback",
"file": "drivers/infiniband/sw/rdmavt/qp.c"
},
"signature_type": "Function",
"id": "CVE-2022-49089-feb97477",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@92f1947c0d26060e978b3a9f21f32ce7c8c9cca3"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "338713871650893470591671066017522030729",
"length": 7407.0
},
"deprecated": false,
"target": {
"function": "rvt_ruc_loopback",
"file": "drivers/infiniband/sw/rdmavt/qp.c"
},
"signature_type": "Function",
"id": "CVE-2022-49089-fed4402f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@57800cc36e55db0547461c49acf5cd84c0f502b0"
}
]