CVE-2022-49446 (GCVE-0-2022-49446)
Vulnerability from cvelistv5
Published
2025-02-26 02:12
Modified
2025-05-04 08:37
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: nvdimm: Fix firmware activation deadlock scenarios Lockdep reports the following deadlock scenarios for CXL root device power-management, device_prepare(), operations, and device_shutdown() operations for 'nd_region' devices: Chain exists of: &nvdimm_region_key --> &nvdimm_bus->reconfig_mutex --> system_transition_mutex Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(system_transition_mutex); lock(&nvdimm_bus->reconfig_mutex); lock(system_transition_mutex); lock(&nvdimm_region_key); Chain exists of: &cxl_nvdimm_bridge_key --> acpi_scan_lock --> &cxl_root_key Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&cxl_root_key); lock(acpi_scan_lock); lock(&cxl_root_key); lock(&cxl_nvdimm_bridge_key); These stem from holding nvdimm_bus_lock() over hibernate_quiet_exec() which walks the entire system device topology taking device_lock() along the way. The nvdimm_bus_lock() is protecting against unregistration, multiple simultaneous ops callers, and preventing activate_show() from racing activate_store(). For the first 2, the lock is redundant. Unregistration already flushes all ops users, and sysfs already prevents multiple threads to be active in an ops handler at the same time. For the last userspace should already be waiting for its last activate_store() to complete, and does not need activate_show() to flush the write side, so this lock usage can be deleted in these attributes.
References
Impacted products
Vendor Product Version
Linux Linux Version: 48001ea50d17f3eb06a552e9ecf21f7fc01b25da
Version: 48001ea50d17f3eb06a552e9ecf21f7fc01b25da
Version: 48001ea50d17f3eb06a552e9ecf21f7fc01b25da
Version: 48001ea50d17f3eb06a552e9ecf21f7fc01b25da
Version: 48001ea50d17f3eb06a552e9ecf21f7fc01b25da
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvdimm/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "641649f31e20df630310f5c22f26c071acc676d4",
              "status": "affected",
              "version": "48001ea50d17f3eb06a552e9ecf21f7fc01b25da",
              "versionType": "git"
            },
            {
              "lessThan": "2f97ebc58d5fc83ca1528cd553fa725472ab3ca8",
              "status": "affected",
              "version": "48001ea50d17f3eb06a552e9ecf21f7fc01b25da",
              "versionType": "git"
            },
            {
              "lessThan": "ceb924ee16b2c8e48dcac3d9ad6be01c40b5a228",
              "status": "affected",
              "version": "48001ea50d17f3eb06a552e9ecf21f7fc01b25da",
              "versionType": "git"
            },
            {
              "lessThan": "2fd853fdb40afc052de338693df1372f2ead7be7",
              "status": "affected",
              "version": "48001ea50d17f3eb06a552e9ecf21f7fc01b25da",
              "versionType": "git"
            },
            {
              "lessThan": "e6829d1bd3c4b58296ee9e412f7ed4d6cb390192",
              "status": "affected",
              "version": "48001ea50d17f3eb06a552e9ecf21f7fc01b25da",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvdimm/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.9"
            },
            {
              "lessThan": "5.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.121",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.121",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.46",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.14",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.3",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvdimm: Fix firmware activation deadlock scenarios\n\nLockdep reports the following deadlock scenarios for CXL root device\npower-management, device_prepare(), operations, and device_shutdown()\noperations for \u0027nd_region\u0027 devices:\n\n Chain exists of:\n   \u0026nvdimm_region_key --\u003e \u0026nvdimm_bus-\u003ereconfig_mutex --\u003e system_transition_mutex\n\n  Possible unsafe locking scenario:\n\n        CPU0                    CPU1\n        ----                    ----\n   lock(system_transition_mutex);\n                                lock(\u0026nvdimm_bus-\u003ereconfig_mutex);\n                                lock(system_transition_mutex);\n   lock(\u0026nvdimm_region_key);\n\n Chain exists of:\n   \u0026cxl_nvdimm_bridge_key --\u003e acpi_scan_lock --\u003e \u0026cxl_root_key\n\n  Possible unsafe locking scenario:\n\n        CPU0                    CPU1\n        ----                    ----\n   lock(\u0026cxl_root_key);\n                                lock(acpi_scan_lock);\n                                lock(\u0026cxl_root_key);\n   lock(\u0026cxl_nvdimm_bridge_key);\n\nThese stem from holding nvdimm_bus_lock() over hibernate_quiet_exec()\nwhich walks the entire system device topology taking device_lock() along\nthe way. The nvdimm_bus_lock() is protecting against unregistration,\nmultiple simultaneous ops callers, and preventing activate_show() from\nracing activate_store(). For the first 2, the lock is redundant.\nUnregistration already flushes all ops users, and sysfs already prevents\nmultiple threads to be active in an ops handler at the same time. For\nthe last userspace should already be waiting for its last\nactivate_store() to complete, and does not need activate_show() to flush\nthe write side, so this lock usage can be deleted in these attributes."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T08:37:55.161Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/641649f31e20df630310f5c22f26c071acc676d4"
        },
        {
          "url": "https://git.kernel.org/stable/c/2f97ebc58d5fc83ca1528cd553fa725472ab3ca8"
        },
        {
          "url": "https://git.kernel.org/stable/c/ceb924ee16b2c8e48dcac3d9ad6be01c40b5a228"
        },
        {
          "url": "https://git.kernel.org/stable/c/2fd853fdb40afc052de338693df1372f2ead7be7"
        },
        {
          "url": "https://git.kernel.org/stable/c/e6829d1bd3c4b58296ee9e412f7ed4d6cb390192"
        }
      ],
      "title": "nvdimm: Fix firmware activation deadlock scenarios",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49446",
    "datePublished": "2025-02-26T02:12:57.876Z",
    "dateReserved": "2025-02-26T02:08:31.571Z",
    "dateUpdated": "2025-05-04T08:37:55.161Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49446\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-26T07:01:21.010\",\"lastModified\":\"2025-03-17T16:12:47.283\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnvdimm: Fix firmware activation deadlock scenarios\\n\\nLockdep reports the following deadlock scenarios for CXL root device\\npower-management, device_prepare(), operations, and device_shutdown()\\noperations for \u0027nd_region\u0027 devices:\\n\\n Chain exists of:\\n   \u0026nvdimm_region_key --\u003e \u0026nvdimm_bus-\u003ereconfig_mutex --\u003e system_transition_mutex\\n\\n  Possible unsafe locking scenario:\\n\\n        CPU0                    CPU1\\n        ----                    ----\\n   lock(system_transition_mutex);\\n                                lock(\u0026nvdimm_bus-\u003ereconfig_mutex);\\n                                lock(system_transition_mutex);\\n   lock(\u0026nvdimm_region_key);\\n\\n Chain exists of:\\n   \u0026cxl_nvdimm_bridge_key --\u003e acpi_scan_lock --\u003e \u0026cxl_root_key\\n\\n  Possible unsafe locking scenario:\\n\\n        CPU0                    CPU1\\n        ----                    ----\\n   lock(\u0026cxl_root_key);\\n                                lock(acpi_scan_lock);\\n                                lock(\u0026cxl_root_key);\\n   lock(\u0026cxl_nvdimm_bridge_key);\\n\\nThese stem from holding nvdimm_bus_lock() over hibernate_quiet_exec()\\nwhich walks the entire system device topology taking device_lock() along\\nthe way. The nvdimm_bus_lock() is protecting against unregistration,\\nmultiple simultaneous ops callers, and preventing activate_show() from\\nracing activate_store(). For the first 2, the lock is redundant.\\nUnregistration already flushes all ops users, and sysfs already prevents\\nmultiple threads to be active in an ops handler at the same time. For\\nthe last userspace should already be waiting for its last\\nactivate_store() to complete, and does not need activate_show() to flush\\nthe write side, so this lock usage can be deleted in these attributes.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nvdimm: Se corrigen los escenarios de bloqueo de activaci\u00f3n de firmware Lockdep informa los siguientes escenarios de bloqueo para la administraci\u00f3n de energ\u00eda del dispositivo ra\u00edz CXL, device_prepare(), operaciones y operaciones device_shutdown() para dispositivos \u0027nd_region\u0027: Existe una cadena de: \u0026amp;nvdimm_region_key --\u0026gt; \u0026amp;nvdimm_bus-\u0026gt;reconfig_mutex --\u0026gt; system_transition_mutex Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(system_transition_mutex); lock(\u0026amp;nvdimm_bus-\u0026gt;reconfig_mutex); lock(system_transition_mutex); lock(\u0026amp;nvdimm_region_key); Chain exists of: \u0026amp;cxl_nvdimm_bridge_key --\u0026gt; acpi_scan_lock --\u0026gt; \u0026amp;cxl_root_key Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(\u0026amp;cxl_root_key); lock(acpi_scan_lock); lock(\u0026amp;cxl_root_key); lock(\u0026amp;cxl_nvdimm_bridge_key); Estos se derivan de mantener nvdimm_bus_lock() sobre hibernate_quiet_exec() que recorre toda la topolog\u00eda del dispositivo del sistema tomando device_lock() en el camino. nvdimm_bus_lock() protege contra la anulaci\u00f3n del registro, m\u00faltiples invocadores de operaciones simult\u00e1neas y evita que activate_show() compita con activate_store(). Para los primeros 2, el bloqueo es redundante. La anulaci\u00f3n del registro ya borra todos los usuarios de operaciones, y sysfs ya evita que varios subprocesos est\u00e9n activos en un controlador de operaciones al mismo tiempo. Para el \u00faltimo espacio de usuario ya deber\u00eda estar esperando a que se complete su \u00faltimo activate_store(), y no necesita activate_show() para borrar el lado de escritura, por lo que este uso de bloqueo se puede eliminar en estos atributos.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-667\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.9\",\"versionEndExcluding\":\"5.10.121\",\"matchCriteriaId\":\"D72A0A66-110A-4144-A452-8FE84D5A41C8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.46\",\"matchCriteriaId\":\"20D41697-0E8B-4B7D-8842-F17BF2AA21E1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.17.14\",\"matchCriteriaId\":\"15E2DD33-2255-4B76-9C15-04FF8CBAB252\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.18\",\"versionEndExcluding\":\"5.18.3\",\"matchCriteriaId\":\"8E122216-2E9E-4B3E-B7B8-D575A45BA3C2\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2f97ebc58d5fc83ca1528cd553fa725472ab3ca8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2fd853fdb40afc052de338693df1372f2ead7be7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/641649f31e20df630310f5c22f26c071acc676d4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ceb924ee16b2c8e48dcac3d9ad6be01c40b5a228\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e6829d1bd3c4b58296ee9e412f7ed4d6cb390192\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.