CVE-2022-49465
- Source
- https://cve.org/CVERecord?id=CVE-2022-49465
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-49465.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2022-49465
- Aliases
- Downstream
- Related
- Published
- 2025-02-26T02:13:10.975Z
- Modified
- 2026-01-19T20:50:58.114948Z
- Severity
-
- 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- blk-throttle: Set BIO_THROTTLED when bio has been throttled
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
blk-throttle: Set BIO_THROTTLED when bio has been throttled
1.In current process, all bio will set the BIOTHROTTLED flag after _blkthrotlbio().
2.If bio needs to be throttled, it will start the timer and stop submit bio directly. Bio will submit in blkthrotldispatchworkfn() when the timer expires.But in the current process, if bio is throttled. The BIO_THROTTLED will be set to bio after timer start. If the bio has been completed, it may cause use-after-free blow.
BUG: KASAN: use-after-free in blkthrotlbio+0x12f0/0x2c70 Read of size 2 at addr ffff88801b8902d4 by task fio/26380
dumpstack+0x9b/0xce printaddressdescription.constprop.6+0x3e/0x60 kasanreport.cold.9+0x22/0x3a blkthrotlbio+0x12f0/0x2c70 submitbiochecks+0x701/0x1550 submitbionoacct+0x83/0xc80 submitbio+0xa7/0x330 mpagereadahead+0x380/0x500 readpages+0x1c1/0xbf0 pagecacheraunbounded+0x471/0x6f0 dopagecachera+0xda/0x110 ondemandreadahead+0x442/0xae0 pagecacheasyncra+0x210/0x300 genericfilebufferedread+0x4d9/0x2130 genericfilereaditer+0x315/0x490 blkdevreaditer+0x113/0x1b0 aioread+0x2ad/0x450 iosubmitone+0xc8e/0x1d60 _sesysiosubmit+0x125/0x350 dosyscall64+0x2d/0x40 entrySYSCALL64afterhwframe+0x44/0xa9
Allocated by task 26380: kasansavestack+0x19/0x40 _kasankmalloc.constprop.2+0xc1/0xd0 kmemcachealloc+0x146/0x440 mempoolalloc+0x125/0x2f0 bioallocbioset+0x353/0x590 mpagealloc+0x3b/0x240 dompagereadpage+0xddf/0x1ef0 mpagereadahead+0x264/0x500 readpages+0x1c1/0xbf0 pagecacheraunbounded+0x471/0x6f0 dopagecachera+0xda/0x110 ondemandreadahead+0x442/0xae0 pagecacheasyncra+0x210/0x300 genericfilebufferedread+0x4d9/0x2130 genericfilereaditer+0x315/0x490 blkdevreaditer+0x113/0x1b0 aioread+0x2ad/0x450 iosubmitone+0xc8e/0x1d60 _sesysiosubmit+0x125/0x350 dosyscall64+0x2d/0x40 entrySYSCALL64after_hwframe+0x44/0xa9
Freed by task 0: kasansavestack+0x19/0x40 kasansettrack+0x1c/0x30 kasansetfreeinfo+0x1b/0x30 _kasanslabfree+0x111/0x160 kmemcachefree+0x94/0x460 mempoolfree+0xd6/0x320 biofree+0xe0/0x130 bioput+0xab/0xe0 bioendio+0x3a6/0x5d0 blkupdaterequest+0x590/0x1370 scsiendrequest+0x7d/0x400 scsiiocompletion+0x1aa/0xe50 scsisoftirqdone+0x11b/0x240 blkmqcompleterequest+0xd4/0x120 scsimqdone+0xf0/0x200 virtscsivqdone+0xbc/0x150 vringinterrupt+0x179/0x390 _handleirqeventpercpu+0xf7/0x490 handleirqeventpercpu+0x7b/0x160 handleirqevent+0xcc/0x170 handleedgeirq+0x215/0xb20 commoninterrupt+0x60/0x120 asmcommoninterrupt+0x1e/0x40
Fix this by move BIOTHROTTLED set into the queuelock.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49465.json", "cna_assigner": "Linux" }- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/047ea38d41d90d748bca812a43339632f52ba715
- https://git.kernel.org/stable/c/0cfc8a0fb07cde61915e4a77c4794c47de3114a4
- https://git.kernel.org/stable/c/24ba80efaf6e772f6132465fad08e20fb4767da7
- https://git.kernel.org/stable/c/5a011f889b4832aa80c2a872a5aade5c48d2756f
- https://git.kernel.org/stable/c/935fa666534d7b7185e8c6b0191cd06281be4290
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49465.json
- https://nvd.nist.gov/vuln/detail/CVE-2022-49465
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced2a0f61e6ecd08d260054bde4b096ff207ce5350fFixed24ba80efaf6e772f6132465fad08e20fb4767da7Fixed047ea38d41d90d748bca812a43339632f52ba715Fixed0cfc8a0fb07cde61915e4a77c4794c47de3114a4Fixed935fa666534d7b7185e8c6b0191cd06281be4290Fixed5a011f889b4832aa80c2a872a5aade5c48d2756f