CVE-2022-48673

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/smc: Fix possible access to freed memory in link clear

After modifying the QP to the Error state, all RX WR would be completed

with WC in IB_WC_WR_FLUSH_ERR status. Current implementation does not

wait for it is done, but destroy the QP and free the link group directly.

So there is a risk that accessing the freed memory in tasklet context.

Here is a crash example:

BUG: unable to handle page fault for address: ffffffff8f220860

#PF: supervisor write access in kernel mode

#PF: error_code(0x0002) - not-present page

PGD f7300e067 P4D f7300e067 PUD f7300f063 PMD 8c4e45063 PTE 800ffff08c9df060

Oops: 0002 [#1] SMP PTI

CPU: 1 PID: 0 Comm: swapper/1 Kdump: loaded Tainted: G S OE 5.10.0-0607+ #23

Hardware name: Inspur NF5280M4/YZMB-00689-101, BIOS 4.1.20 07/09/2018

RIP: 0010:native_queued_spin_lock_slowpath+0x176/0x1b0

Code: f3 90 48 8b 32 48 85 f6 74 f6 eb d5 c1 ee 12 83 e0 03 83 ee 01 48 c1 e0 05 48

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References