CVE-2022-48991 (GCVE-0-2022-48991)

Vulnerability from cvelistv5 – Published: 2024-10-21 20:06 – Updated: 2025-05-04 08:27
VLAI?
Title
mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths
Summary
In the Linux kernel, the following vulnerability has been resolved: mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths Any codepath that zaps page table entries must invoke MMU notifiers to ensure that secondary MMUs (like KVM) don't keep accessing pages which aren't mapped anymore. Secondary MMUs don't hold their own references to pages that are mirrored over, so failing to notify them can lead to page use-after-free. I'm marking this as addressing an issue introduced in commit f3f0e1d2150b ("khugepaged: add support of collapse for tmpfs/shmem pages"), but most of the security impact of this only came in commit 27e1f8273113 ("khugepaged: enable collapse pmd for pte-mapped THP"), which actually omitted flushes for the removal of present PTEs, not just for the removal of empty page tables.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: f3f0e1d2150b2b99da2cbdfaad000089efe9bf30 , < 275c626c131cfe141beeb6c575e31fa53d32da19 (git)
Affected: f3f0e1d2150b2b99da2cbdfaad000089efe9bf30 , < c23105673228c349739e958fa33955ed8faddcaf (git)
Affected: f3f0e1d2150b2b99da2cbdfaad000089efe9bf30 , < ff2a1a6f869650aec99e9d070b5ab625bfbc5bc3 (git)
Affected: f3f0e1d2150b2b99da2cbdfaad000089efe9bf30 , < 5ffc2a75534d9d74d49760f983f8eb675fa63d69 (git)
Affected: f3f0e1d2150b2b99da2cbdfaad000089efe9bf30 , < 7f445ca2e0e59c7971d0b7b853465e50844ab596 (git)
Affected: f3f0e1d2150b2b99da2cbdfaad000089efe9bf30 , < 1a3f8c6cd29d9078cc81b29d39d0e9ae1d6a03c3 (git)
Affected: f3f0e1d2150b2b99da2cbdfaad000089efe9bf30 , < 5450535901d89a5dcca5fbbc59a24fe89caeb465 (git)
Affected: f3f0e1d2150b2b99da2cbdfaad000089efe9bf30 , < f268f6cf875f3220afc77bdd0bf1bb136eb54db9 (git)
Create a notification for this product.
    Linux Linux Affected: 4.8
Unaffected: 0 , < 4.8 (semver)
Unaffected: 4.9.337 , ≤ 4.9.* (semver)
Unaffected: 4.14.303 , ≤ 4.14.* (semver)
Unaffected: 4.19.270 , ≤ 4.19.* (semver)
Unaffected: 5.4.227 , ≤ 5.4.* (semver)
Unaffected: 5.10.159 , ≤ 5.10.* (semver)
Unaffected: 5.15.83 , ≤ 5.15.* (semver)
Unaffected: 6.0.13 , ≤ 6.0.* (semver)
Unaffected: 6.1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-48991",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-22T13:16:32.481668Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-22T13:18:42.186Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/khugepaged.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "275c626c131cfe141beeb6c575e31fa53d32da19",
              "status": "affected",
              "version": "f3f0e1d2150b2b99da2cbdfaad000089efe9bf30",
              "versionType": "git"
            },
            {
              "lessThan": "c23105673228c349739e958fa33955ed8faddcaf",
              "status": "affected",
              "version": "f3f0e1d2150b2b99da2cbdfaad000089efe9bf30",
              "versionType": "git"
            },
            {
              "lessThan": "ff2a1a6f869650aec99e9d070b5ab625bfbc5bc3",
              "status": "affected",
              "version": "f3f0e1d2150b2b99da2cbdfaad000089efe9bf30",
              "versionType": "git"
            },
            {
              "lessThan": "5ffc2a75534d9d74d49760f983f8eb675fa63d69",
              "status": "affected",
              "version": "f3f0e1d2150b2b99da2cbdfaad000089efe9bf30",
              "versionType": "git"
            },
            {
              "lessThan": "7f445ca2e0e59c7971d0b7b853465e50844ab596",
              "status": "affected",
              "version": "f3f0e1d2150b2b99da2cbdfaad000089efe9bf30",
              "versionType": "git"
            },
            {
              "lessThan": "1a3f8c6cd29d9078cc81b29d39d0e9ae1d6a03c3",
              "status": "affected",
              "version": "f3f0e1d2150b2b99da2cbdfaad000089efe9bf30",
              "versionType": "git"
            },
            {
              "lessThan": "5450535901d89a5dcca5fbbc59a24fe89caeb465",
              "status": "affected",
              "version": "f3f0e1d2150b2b99da2cbdfaad000089efe9bf30",
              "versionType": "git"
            },
            {
              "lessThan": "f268f6cf875f3220afc77bdd0bf1bb136eb54db9",
              "status": "affected",
              "version": "f3f0e1d2150b2b99da2cbdfaad000089efe9bf30",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/khugepaged.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.8"
            },
            {
              "lessThan": "4.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.337",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.303",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.227",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.159",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.83",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.337",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.303",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.270",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.227",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.159",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.83",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.13",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/khugepaged: invoke MMU notifiers in shmem/file collapse paths\n\nAny codepath that zaps page table entries must invoke MMU notifiers to\nensure that secondary MMUs (like KVM) don\u0027t keep accessing pages which\naren\u0027t mapped anymore.  Secondary MMUs don\u0027t hold their own references to\npages that are mirrored over, so failing to notify them can lead to page\nuse-after-free.\n\nI\u0027m marking this as addressing an issue introduced in commit f3f0e1d2150b\n(\"khugepaged: add support of collapse for tmpfs/shmem pages\"), but most of\nthe security impact of this only came in commit 27e1f8273113 (\"khugepaged:\nenable collapse pmd for pte-mapped THP\"), which actually omitted flushes\nfor the removal of present PTEs, not just for the removal of empty page\ntables."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T08:27:39.085Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/275c626c131cfe141beeb6c575e31fa53d32da19"
        },
        {
          "url": "https://git.kernel.org/stable/c/c23105673228c349739e958fa33955ed8faddcaf"
        },
        {
          "url": "https://git.kernel.org/stable/c/ff2a1a6f869650aec99e9d070b5ab625bfbc5bc3"
        },
        {
          "url": "https://git.kernel.org/stable/c/5ffc2a75534d9d74d49760f983f8eb675fa63d69"
        },
        {
          "url": "https://git.kernel.org/stable/c/7f445ca2e0e59c7971d0b7b853465e50844ab596"
        },
        {
          "url": "https://git.kernel.org/stable/c/1a3f8c6cd29d9078cc81b29d39d0e9ae1d6a03c3"
        },
        {
          "url": "https://git.kernel.org/stable/c/5450535901d89a5dcca5fbbc59a24fe89caeb465"
        },
        {
          "url": "https://git.kernel.org/stable/c/f268f6cf875f3220afc77bdd0bf1bb136eb54db9"
        }
      ],
      "title": "mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48991",
    "datePublished": "2024-10-21T20:06:08.312Z",
    "dateReserved": "2024-08-22T01:27:53.636Z",
    "dateUpdated": "2025-05-04T08:27:39.085Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-48991\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-22T13:16:32.481668Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-22T13:16:37.120Z\"}}], \"cna\": {\"title\": \"mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"f3f0e1d2150b2b99da2cbdfaad000089efe9bf30\", \"lessThan\": \"275c626c131cfe141beeb6c575e31fa53d32da19\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f3f0e1d2150b2b99da2cbdfaad000089efe9bf30\", \"lessThan\": \"c23105673228c349739e958fa33955ed8faddcaf\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f3f0e1d2150b2b99da2cbdfaad000089efe9bf30\", \"lessThan\": \"ff2a1a6f869650aec99e9d070b5ab625bfbc5bc3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f3f0e1d2150b2b99da2cbdfaad000089efe9bf30\", \"lessThan\": \"5ffc2a75534d9d74d49760f983f8eb675fa63d69\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f3f0e1d2150b2b99da2cbdfaad000089efe9bf30\", \"lessThan\": \"7f445ca2e0e59c7971d0b7b853465e50844ab596\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f3f0e1d2150b2b99da2cbdfaad000089efe9bf30\", \"lessThan\": \"1a3f8c6cd29d9078cc81b29d39d0e9ae1d6a03c3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f3f0e1d2150b2b99da2cbdfaad000089efe9bf30\", \"lessThan\": \"5450535901d89a5dcca5fbbc59a24fe89caeb465\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f3f0e1d2150b2b99da2cbdfaad000089efe9bf30\", \"lessThan\": \"f268f6cf875f3220afc77bdd0bf1bb136eb54db9\", \"versionType\": \"git\"}], \"programFiles\": [\"mm/khugepaged.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.8\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.8\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.9.337\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.9.*\"}, {\"status\": \"unaffected\", \"version\": \"4.14.303\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.14.*\"}, {\"status\": \"unaffected\", \"version\": \"4.19.270\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.227\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.159\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.83\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.0.13\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.0.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"mm/khugepaged.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/275c626c131cfe141beeb6c575e31fa53d32da19\"}, {\"url\": \"https://git.kernel.org/stable/c/c23105673228c349739e958fa33955ed8faddcaf\"}, {\"url\": \"https://git.kernel.org/stable/c/ff2a1a6f869650aec99e9d070b5ab625bfbc5bc3\"}, {\"url\": \"https://git.kernel.org/stable/c/5ffc2a75534d9d74d49760f983f8eb675fa63d69\"}, {\"url\": \"https://git.kernel.org/stable/c/7f445ca2e0e59c7971d0b7b853465e50844ab596\"}, {\"url\": \"https://git.kernel.org/stable/c/1a3f8c6cd29d9078cc81b29d39d0e9ae1d6a03c3\"}, {\"url\": \"https://git.kernel.org/stable/c/5450535901d89a5dcca5fbbc59a24fe89caeb465\"}, {\"url\": \"https://git.kernel.org/stable/c/f268f6cf875f3220afc77bdd0bf1bb136eb54db9\"}], \"x_generator\": {\"engine\": \"bippy-5f407fcff5a0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm/khugepaged: invoke MMU notifiers in shmem/file collapse paths\\n\\nAny codepath that zaps page table entries must invoke MMU notifiers to\\nensure that secondary MMUs (like KVM) don\u0027t keep accessing pages which\\naren\u0027t mapped anymore.  Secondary MMUs don\u0027t hold their own references to\\npages that are mirrored over, so failing to notify them can lead to page\\nuse-after-free.\\n\\nI\u0027m marking this as addressing an issue introduced in commit f3f0e1d2150b\\n(\\\"khugepaged: add support of collapse for tmpfs/shmem pages\\\"), but most of\\nthe security impact of this only came in commit 27e1f8273113 (\\\"khugepaged:\\nenable collapse pmd for pte-mapped THP\\\"), which actually omitted flushes\\nfor the removal of present PTEs, not just for the removal of empty page\\ntables.\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-12-19T08:12:02.610Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-48991\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-12-19T08:12:02.610Z\", \"dateReserved\": \"2024-08-22T01:27:53.636Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T20:06:08.312Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.