CVE-2022-48671
cgroup: Add missing cpus_read_lock() to cgroup_attach_task_all()
MEDIUM 5.5
At a glance
- Source
- NVD
- EPSS
- EPSS 0.18 % · percentile 7 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Modified
Description
In the Linux kernel, the following vulnerability has been resolved: cgroup: Add missing cpus_read_lock() to cgroup_attach_task_all() syzbot is hitting percpu_rwsem_assert_held(&cpu_hotplug_lock) warning at cpuset_attach() [1], for commit 4f7e7236435ca0ab ("cgroup: Fix threadgroup_rwsem <-> cpus_read_lock() deadlock") missed that cpuset_attach() is also called from cgroup_attach_task_all(). Add cpus_read_lock() like what cgroup_procs_write_start() does.
Weaknesses (CWE)
- CWE-667 — Improper Locking
References
- https://git.kernel.org/stable/c/321488cfac7d0eb6d97de467015ff754f85813ff
- https://git.kernel.org/stable/c/07191f984842d50020789ff14c75da436a7f46a9
- https://git.kernel.org/stable/c/9f267393b036f1470fb12fb892d59e7ff8aeb58d
- https://git.kernel.org/stable/c/5db17805b6ba4c34dab303f49aea3562fc25af75
- https://git.kernel.org/stable/c/99bc25748e394d17f9e8b10cc7f273b8e64c1c7e
- https://git.kernel.org/stable/c/43626dade36fa74d3329046f4ae2d7fdefe401c6
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | CISA-ADP |
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
European references
- ENISA EUVD · EUVD-2022-51366
- GCVE · GCVE-0-2022-48671
CERT-FR advisories
- CERTFR-2025-AVI-0088 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0526 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0496 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0420 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.4.213 < 5.4.215cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.10.143 < 5.10.145cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*> 5.15.68 < 5.15.70cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.19.9 < 5.19.11
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected e446300968c6bd25d9cd6c33b9600780a39b3975 < 321488cfac7d0eb6d97de467015ff754f85813ff ; affected 59c6902a96b4439e07c25ef86a4593bea5481c3b < 07191f984842d50020789ff14c75da436a7f46a9 ; affected dee1e2b18cf5426eed985512ccc6636ec69dbdd6 < 9f267393b036f1470fb12fb892d59e7ff8aeb58d ; affected 3bf4bf54069f9b62a54988e5d085023c17a66c90 < 5db17805b6ba4c34dab303f49aea3562fc25af75 ; affected c0deb027c99c099aa6b831e326bfba802b25e774 < 99bc25748e394d17f9e8b10cc7f273b8e64c1c7e ; affected 4f7e7236435ca0abe005c674ebd6892c6e83aeb3 < 43626dade36fa74d3329046f4ae2d7fdefe401c6 |
| Linux · Linux | affected 5.4.213 < 5.4.215 ; affected 5.10.143 < 5.10.145 ; affected 5.15.68 < 5.15.70 ; affected 5.19.9 < 5.19.11 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |