CVE-2022-48816CWE-476

CVE-2022-48816

High · published July 16, 2024

CVSS v3.1
7.8
EPSS
0%
Percentile
19.9
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: lock against ->sock changing during sysfs read

->sock can be set to NULL asynchronously unless ->recv_mutex is held.

So it is important to hold that mutex. Otherwise a sysfs read can

trigger an oops.

Commit 17f09d3f619a ("SUNRPC: Check if the xprt is connected before

handling sysfs reads") appears to attempt to fix this problem, but it

only narrows the race window.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00285 · 19.9th percentile
Weakness
CWE-476 · NULL Pointer Dereference
Published
2024-07-16T16:15Z
Affected products (5)
ProductVersionsFixed in
linux/linux_kernel≥ 5.10.67, < 5.115.11
linux/linux_kernel≥ 5.13.19, < 5.16.105.16.10
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (6)
EPSS history
Timeline
  • 16 JUL 11:44Z
    SUNRPC: lock against ->sock changing during sysfs read
    cvelistv5