CVE-2022-48731 (GCVE-0-2022-48731)
Vulnerability from cvelistv5
Published
2024-06-20 11:13
Modified
2025-05-04 08:21
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mm/kmemleak: avoid scanning potential huge holes
When using devm_request_free_mem_region() and devm_memremap_pages() to
add ZONE_DEVICE memory, if requested free mem region's end pfn were
huge(e.g., 0x400000000), the node_end_pfn() will be also huge (see
move_pfn_range_to_zone()). Thus it creates a huge hole between
node_start_pfn() and node_end_pfn().
We found on some AMD APUs, amdkfd requested such a free mem region and
created a huge hole. In such a case, following code snippet was just
doing busy test_bit() looping on the huge hole.
for (pfn = start_pfn; pfn < end_pfn; pfn++) {
struct page *page = pfn_to_online_page(pfn);
if (!page)
continue;
...
}
So we got a soft lockup:
watchdog: BUG: soft lockup - CPU#6 stuck for 26s! [bash:1221]
CPU: 6 PID: 1221 Comm: bash Not tainted 5.15.0-custom #1
RIP: 0010:pfn_to_online_page+0x5/0xd0
Call Trace:
? kmemleak_scan+0x16a/0x440
kmemleak_write+0x306/0x3a0
? common_file_perm+0x72/0x170
full_proxy_write+0x5c/0x90
vfs_write+0xb9/0x260
ksys_write+0x67/0xe0
__x64_sys_write+0x1a/0x20
do_syscall_64+0x3b/0xc0
entry_SYSCALL_64_after_hwframe+0x44/0xae
I did some tests with the patch.
(1) amdgpu module unloaded
before the patch:
real 0m0.976s
user 0m0.000s
sys 0m0.968s
after the patch:
real 0m0.981s
user 0m0.000s
sys 0m0.973s
(2) amdgpu module loaded
before the patch:
real 0m35.365s
user 0m0.000s
sys 0m35.354s
after the patch:
real 0m1.049s
user 0m0.000s
sys 0m1.042s
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2022-48731",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-20T13:35:34.134503Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-noinfo Not enough information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-29T18:12:10.030Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-03T15:25:01.574Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/d3533ee20e9a0e2e8f60384da7450d43d1c63d1a"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/352715593e81b917ce1b321e794549815b850134"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/a5389c80992f0001ee505838fe6a8b20897ce96e"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/cebb0aceb21ad91429617a40e3a17444fabf1529"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/c10a0f877fe007021d70f9cada240f42adc2b5db"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"mm/kmemleak.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d3533ee20e9a0e2e8f60384da7450d43d1c63d1a",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "352715593e81b917ce1b321e794549815b850134",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "a5389c80992f0001ee505838fe6a8b20897ce96e",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "cebb0aceb21ad91429617a40e3a17444fabf1529",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "c10a0f877fe007021d70f9cada240f42adc2b5db",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"mm/kmemleak.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.99",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.16.*",
"status": "unaffected",
"version": "5.16.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "5.17",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.178",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.99",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.16.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/kmemleak: avoid scanning potential huge holes\n\nWhen using devm_request_free_mem_region() and devm_memremap_pages() to\nadd ZONE_DEVICE memory, if requested free mem region\u0027s end pfn were\nhuge(e.g., 0x400000000), the node_end_pfn() will be also huge (see\nmove_pfn_range_to_zone()). Thus it creates a huge hole between\nnode_start_pfn() and node_end_pfn().\n\nWe found on some AMD APUs, amdkfd requested such a free mem region and\ncreated a huge hole. In such a case, following code snippet was just\ndoing busy test_bit() looping on the huge hole.\n\n for (pfn = start_pfn; pfn \u003c end_pfn; pfn++) {\n\tstruct page *page = pfn_to_online_page(pfn);\n\t\tif (!page)\n\t\t\tcontinue;\n\t...\n }\n\nSo we got a soft lockup:\n\n watchdog: BUG: soft lockup - CPU#6 stuck for 26s! [bash:1221]\n CPU: 6 PID: 1221 Comm: bash Not tainted 5.15.0-custom #1\n RIP: 0010:pfn_to_online_page+0x5/0xd0\n Call Trace:\n ? kmemleak_scan+0x16a/0x440\n kmemleak_write+0x306/0x3a0\n ? common_file_perm+0x72/0x170\n full_proxy_write+0x5c/0x90\n vfs_write+0xb9/0x260\n ksys_write+0x67/0xe0\n __x64_sys_write+0x1a/0x20\n do_syscall_64+0x3b/0xc0\n entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nI did some tests with the patch.\n\n(1) amdgpu module unloaded\n\nbefore the patch:\n\n real 0m0.976s\n user 0m0.000s\n sys 0m0.968s\n\nafter the patch:\n\n real 0m0.981s\n user 0m0.000s\n sys 0m0.973s\n\n(2) amdgpu module loaded\n\nbefore the patch:\n\n real 0m35.365s\n user 0m0.000s\n sys 0m35.354s\n\nafter the patch:\n\n real 0m1.049s\n user 0m0.000s\n sys 0m1.042s"
}
],
"providerMetadata": {
"dateUpdated": "2025-05-04T08:21:55.868Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d3533ee20e9a0e2e8f60384da7450d43d1c63d1a"
},
{
"url": "https://git.kernel.org/stable/c/352715593e81b917ce1b321e794549815b850134"
},
{
"url": "https://git.kernel.org/stable/c/a5389c80992f0001ee505838fe6a8b20897ce96e"
},
{
"url": "https://git.kernel.org/stable/c/cebb0aceb21ad91429617a40e3a17444fabf1529"
},
{
"url": "https://git.kernel.org/stable/c/c10a0f877fe007021d70f9cada240f42adc2b5db"
}
],
"title": "mm/kmemleak: avoid scanning potential huge holes",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2022-48731",
"datePublished": "2024-06-20T11:13:19.407Z",
"dateReserved": "2024-06-20T11:09:39.053Z",
"dateUpdated": "2025-05-04T08:21:55.868Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2022-48731\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-06-20T12:15:11.517\",\"lastModified\":\"2025-04-01T18:27:59.233\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm/kmemleak: avoid scanning potential huge holes\\n\\nWhen using devm_request_free_mem_region() and devm_memremap_pages() to\\nadd ZONE_DEVICE memory, if requested free mem region\u0027s end pfn were\\nhuge(e.g., 0x400000000), the node_end_pfn() will be also huge (see\\nmove_pfn_range_to_zone()). Thus it creates a huge hole between\\nnode_start_pfn() and node_end_pfn().\\n\\nWe found on some AMD APUs, amdkfd requested such a free mem region and\\ncreated a huge hole. In such a case, following code snippet was just\\ndoing busy test_bit() looping on the huge hole.\\n\\n for (pfn = start_pfn; pfn \u003c end_pfn; pfn++) {\\n\\tstruct page *page = pfn_to_online_page(pfn);\\n\\t\\tif (!page)\\n\\t\\t\\tcontinue;\\n\\t...\\n }\\n\\nSo we got a soft lockup:\\n\\n watchdog: BUG: soft lockup - CPU#6 stuck for 26s! [bash:1221]\\n CPU: 6 PID: 1221 Comm: bash Not tainted 5.15.0-custom #1\\n RIP: 0010:pfn_to_online_page+0x5/0xd0\\n Call Trace:\\n ? kmemleak_scan+0x16a/0x440\\n kmemleak_write+0x306/0x3a0\\n ? common_file_perm+0x72/0x170\\n full_proxy_write+0x5c/0x90\\n vfs_write+0xb9/0x260\\n ksys_write+0x67/0xe0\\n __x64_sys_write+0x1a/0x20\\n do_syscall_64+0x3b/0xc0\\n entry_SYSCALL_64_after_hwframe+0x44/0xae\\n\\nI did some tests with the patch.\\n\\n(1) amdgpu module unloaded\\n\\nbefore the patch:\\n\\n real 0m0.976s\\n user 0m0.000s\\n sys 0m0.968s\\n\\nafter the patch:\\n\\n real 0m0.981s\\n user 0m0.000s\\n sys 0m0.973s\\n\\n(2) amdgpu module loaded\\n\\nbefore the patch:\\n\\n real 0m35.365s\\n user 0m0.000s\\n sys 0m35.354s\\n\\nafter the patch:\\n\\n real 0m1.049s\\n user 0m0.000s\\n sys 0m1.042s\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mm/kmemleak: evita escanear posibles agujeros enormes. Al usar devm_request_free_mem_region() y devm_memremap_pages() para agregar memoria ZONE_DEVICE, si se solicitaba, el pfn final de la regi\u00f3n de memoria libre era enorme (por ejemplo, 0x400000000), el node_end_pfn() tambi\u00e9n ser\u00e1 enorme (ver move_pfn_range_to_zone()). Por lo tanto, crea un enorme agujero entre node_start_pfn() y node_end_pfn(). Descubrimos que en algunas APU AMD, AMDKFD solicit\u00f3 una regi\u00f3n de memoria libre y cre\u00f3 un agujero enorme. En tal caso, el siguiente fragmento de c\u00f3digo simplemente estaba haciendo un bucle test_bit() ocupado en el enorme agujero. for (pfn = start_pfn; pfn \u0026lt; end_pfn; pfn++) { estructura p\u00e1gina *p\u00e1gina = pfn_to_online_page(pfn); si (!p\u00e1gina) contin\u00faa; ... } Entonces obtuvimos un bloqueo suave: perro guardi\u00e1n: ERROR: bloqueo suave - \u00a1CPU#6 bloqueada durante 26 segundos! [bash:1221] CPU: 6 PID: 1221 Comm: bash No contaminado 5.15.0-custom #1 RIP: 0010:pfn_to_online_page+0x5/0xd0 Seguimiento de llamadas:? kmemleak_scan+0x16a/0x440 kmemleak_write+0x306/0x3a0 ? common_file_perm+0x72/0x170 full_proxy_write+0x5c/0x90 vfs_write+0xb9/0x260 ksys_write+0x67/0xe0 __x64_sys_write+0x1a/0x20 do_syscall_64+0x3b/0xc0 Entry_SYSCALL_64_after_hwframe+0x4 4/0xae Hice algunas pruebas con el parche. (1) m\u00f3dulo amdgpu descargado antes del parche: usuario real 0m0.976s 0m0.000s sys 0m0.968s despu\u00e9s del parche: usuario real 0m0.981s 0m0.000s sys 0m0.973s (2) m\u00f3dulo amdgpu cargado antes del parche: real 0m35 .365s usuario 0m0.000s sys 0m35.354s despu\u00e9s del parche: real 0m1.049s usuario 0m0.000s sys 0m1.042s\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-667\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.4.178\",\"matchCriteriaId\":\"A55ED659-C576-45B7-A8B0-3CD30AA67FAB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.99\",\"matchCriteriaId\":\"FA1C3B80-458E-4F34-A0BF-5223557F2863\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.22\",\"matchCriteriaId\":\"74528AA6-B524-4C3F-B188-1194235FE47D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.16.8\",\"matchCriteriaId\":\"0623892A-E3E4-44E6-8A5E-39A0B47AF782\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.17:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"7BD5F8D9-54FA-4CB0-B4F0-CB0471FDDB2D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.17:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"E6E34B23-78B4-4516-9BD8-61B33F4AC49A\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/352715593e81b917ce1b321e794549815b850134\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a5389c80992f0001ee505838fe6a8b20897ce96e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c10a0f877fe007021d70f9cada240f42adc2b5db\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cebb0aceb21ad91429617a40e3a17444fabf1529\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d3533ee20e9a0e2e8f60384da7450d43d1c63d1a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/352715593e81b917ce1b321e794549815b850134\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a5389c80992f0001ee505838fe6a8b20897ce96e\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c10a0f877fe007021d70f9cada240f42adc2b5db\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cebb0aceb21ad91429617a40e3a17444fabf1529\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d3533ee20e9a0e2e8f60384da7450d43d1c63d1a\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/d3533ee20e9a0e2e8f60384da7450d43d1c63d1a\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/352715593e81b917ce1b321e794549815b850134\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/a5389c80992f0001ee505838fe6a8b20897ce96e\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/cebb0aceb21ad91429617a40e3a17444fabf1529\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/c10a0f877fe007021d70f9cada240f42adc2b5db\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T15:25:01.574Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-48731\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-20T13:35:34.134503Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"description\": \"CWE-noinfo Not enough information\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-20T13:35:38.300Z\"}}], \"cna\": {\"title\": \"mm/kmemleak: avoid scanning potential huge holes\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\", \"lessThan\": \"d3533ee20e9a0e2e8f60384da7450d43d1c63d1a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\", \"lessThan\": \"352715593e81b917ce1b321e794549815b850134\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\", \"lessThan\": \"a5389c80992f0001ee505838fe6a8b20897ce96e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\", \"lessThan\": \"cebb0aceb21ad91429617a40e3a17444fabf1529\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\", \"lessThan\": \"c10a0f877fe007021d70f9cada240f42adc2b5db\", \"versionType\": \"git\"}], \"programFiles\": [\"mm/kmemleak.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"5.4.178\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.99\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.22\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"5.16.8\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.16.*\"}, {\"status\": \"unaffected\", \"version\": \"5.17\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"mm/kmemleak.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/d3533ee20e9a0e2e8f60384da7450d43d1c63d1a\"}, {\"url\": \"https://git.kernel.org/stable/c/352715593e81b917ce1b321e794549815b850134\"}, {\"url\": \"https://git.kernel.org/stable/c/a5389c80992f0001ee505838fe6a8b20897ce96e\"}, {\"url\": \"https://git.kernel.org/stable/c/cebb0aceb21ad91429617a40e3a17444fabf1529\"}, {\"url\": \"https://git.kernel.org/stable/c/c10a0f877fe007021d70f9cada240f42adc2b5db\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm/kmemleak: avoid scanning potential huge holes\\n\\nWhen using devm_request_free_mem_region() and devm_memremap_pages() to\\nadd ZONE_DEVICE memory, if requested free mem region\u0027s end pfn were\\nhuge(e.g., 0x400000000), the node_end_pfn() will be also huge (see\\nmove_pfn_range_to_zone()). Thus it creates a huge hole between\\nnode_start_pfn() and node_end_pfn().\\n\\nWe found on some AMD APUs, amdkfd requested such a free mem region and\\ncreated a huge hole. In such a case, following code snippet was just\\ndoing busy test_bit() looping on the huge hole.\\n\\n for (pfn = start_pfn; pfn \u003c end_pfn; pfn++) {\\n\\tstruct page *page = pfn_to_online_page(pfn);\\n\\t\\tif (!page)\\n\\t\\t\\tcontinue;\\n\\t...\\n }\\n\\nSo we got a soft lockup:\\n\\n watchdog: BUG: soft lockup - CPU#6 stuck for 26s! [bash:1221]\\n CPU: 6 PID: 1221 Comm: bash Not tainted 5.15.0-custom #1\\n RIP: 0010:pfn_to_online_page+0x5/0xd0\\n Call Trace:\\n ? kmemleak_scan+0x16a/0x440\\n kmemleak_write+0x306/0x3a0\\n ? common_file_perm+0x72/0x170\\n full_proxy_write+0x5c/0x90\\n vfs_write+0xb9/0x260\\n ksys_write+0x67/0xe0\\n __x64_sys_write+0x1a/0x20\\n do_syscall_64+0x3b/0xc0\\n entry_SYSCALL_64_after_hwframe+0x44/0xae\\n\\nI did some tests with the patch.\\n\\n(1) amdgpu module unloaded\\n\\nbefore the patch:\\n\\n real 0m0.976s\\n user 0m0.000s\\n sys 0m0.968s\\n\\nafter the patch:\\n\\n real 0m0.981s\\n user 0m0.000s\\n sys 0m0.973s\\n\\n(2) amdgpu module loaded\\n\\nbefore the patch:\\n\\n real 0m35.365s\\n user 0m0.000s\\n sys 0m35.354s\\n\\nafter the patch:\\n\\n real 0m1.049s\\n user 0m0.000s\\n sys 0m1.042s\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.178\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.99\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.22\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.16.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.17\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T08:21:55.868Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2022-48731\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T08:21:55.868Z\", \"dateReserved\": \"2024-06-20T11:09:39.053Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-06-20T11:13:19.407Z\", \"assignerShortName\": \"Linux\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…