CyberSecBulletin
CVE-2022-48760NVD status: Analyzed

Linux: Improper Locking

Published Updated By the CyberSecBulletin desk

CVE-2022-48760 is a high-severity improper locking vulnerability in Linux, with a CVSS 3.1 base score of 7.1 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 5f138ef224dffd15d5e5c5b095859719e0038427, b50f5ca60475710bbc9a3af32fbfc17b1e69c2f0, 546ba238535d925254e0b3f12012a5c55801e2f3 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.19% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 5f138ef224dffd15d5e5c5b095859719e0038427 or b50f5ca60475710bbc9a3af32fbfc17b1e69c2f0 or 546ba238535d925254e0b3f12012a5c55801e2f3 or 5904dfd3ddaff3bf4a41c3baf0a8e8f31ed4599b, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 4.4.302 or 4.9.300 or 4.14.265 or 4.19.228, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux49367d8f1d9f26482cf7089489e90f0afd0a942c up to, but not including, 5f138ef224dffd15d5e5c5b095859719e0038427; 49367d8f1d9f26482cf7089489e90f0afd0a942c up to, but not including, b50f5ca60475710bbc9a3af32fbfc17b1e69c2f0; 49367d8f1d9f26482cf7089489e90f0afd0a942c up to, but not including, 546ba238535d925254e0b3f12012a5c55801e2f3; 49367d8f1d9f26482cf7089489e90f0afd0a942c up to, but not including, 5904dfd3ddaff3bf4a41c3baf0a8e8f31ed4599b; 49367d8f1d9f26482cf7089489e90f0afd0a942c up to, but not including, 9c61fce322ac2ef7fecf025285353570d60e41d6; 49367d8f1d9f26482cf7089489e90f0afd0a942c up to, but not including, e3b131e30e612ff0e32de6c1cb4f69f89db29193; 49367d8f1d9f26482cf7089489e90f0afd0a942c up to, but not including, 9340226388c66a7e090ebb00e91ed64a753b6c26; 49367d8f1d9f26482cf7089489e90f0afd0a942c up to, but not including, c9a18f7c5b071dce5e6939568829d40994866ab0; and 2 more ranges5f138ef224dffd15d5e5c5b095859719e0038427, b50f5ca60475710bbc9a3af32fbfc17b1e69c2f0, 546ba238535d925254e0b3f12012a5c55801e2f3, 5904dfd3ddaff3bf4a41c3baf0a8e8f31ed4599b, 9c61fce322ac2ef7fecf025285353570d60e41d6, e3b131e30e612ff0e32de6c1cb4f69f89db29193
LinuxLinux Kernelbefore 4.4.302; 4.5 up to, but not including, 4.9.300; 4.10 up to, but not including, 4.14.265; 4.15 up to, but not including, 4.19.228; 4.20 up to, but not including, 5.4.176; 5.5 up to, but not including, 5.10.96; 5.11 up to, but not including, 5.15.19; 5.16 up to, but not including, 5.16.5; and 1 more ranges4.4.302, 4.9.300, 4.14.265, 4.19.228, 5.4.176, 5.10.96

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. Scored by NVD.

Official description

In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix hang in usb_kill_urb by adding memory barriers The syzbot fuzzer has identified a bug in which processes hang waiting for usb_kill_urb() to return. It turns out the issue is not unlinking the URB; that works just fine. Rather, the problem arises when the wakeup notification that the URB has completed is not received. The reason is memory-access ordering on SMP systems. In outline form, usb_kill_urb() and __usb_hcd_giveback_urb() operating concurrently on different CPUs perform the following actions: CPU 0 CPU 1 ---------------------------- --------------------------------- usb_kill_urb(): __usb_hcd_giveback_urb(): ... ... atomic_inc(&urb->reject); atomic_dec(&urb->use_count); ... ... wait_event(usb_kill_urb_queue, atomic_read(&urb->use_count) == 0); if (atomic_read(&urb->reject)) wake_up(&usb_kill_urb_queue); Confining your attention to urb->reject and urb->use_count, you can see that the overall pattern of accesses on CPU 0 is: write urb->reject, then read urb->use_count; whereas the overall pattern of accesses on CPU 1 is: write urb->use_count, then read urb->reject. This pattern is referred to in memory-model circles as SB (for "Store Buffering"), and it is well known that without suitable enforcement of the desired order of accesses -- in the form of memory barriers -- it is entirely possible for one or both CPUs to execute their reads ahead of their writes. The end result will be that sometimes CPU 0 sees the old un-decremented value of urb->use_count while CPU 1 sees the old un-incremented value of urb->reject. Consequently CPU 0 ends up on the wait queue and never gets woken up, leading to the observed hang in usb_kill_urb(). The same pattern of accesses occurs in usb_poison_urb() and the failure pathway of usb_hcd_submit_urb(). The problem is fixed by adding suitable memory barriers. To provide proper memory-access ordering in the SB pattern, a full barrier is required on both CPUs. The atomic_inc() and atomic_dec() accesses themselves don't provide any memory ordering, but since they are present, we can use the optimized smp_mb__after_atomic() memory barrier in the various routines to obtain the desired effect. This patch adds the necessary memory barriers.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Improper Locking

The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.

How developers prevent this class of flaw

  • Use industry standard APIs to implement locking mechanism.

More Improper Locking vulnerabilities (CWE-667)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Improper Locking vulnerabilities

Spotted an error? Tell us.