CVE-2022-48788

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2022-48788", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-07-16T11:38:08.892Z", "datePublished": "2024-07-16T11:43:45.213Z", "dateUpdated": "2026-08-05T08:52:18.532Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:52:18.532Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-rdma: fix possible use-after-free in transport error_recovery work\n\nWhile nvme_rdma_submit_async_event_work is checking the ctrl and queue\nstate before preparing the AER command and scheduling io_work, in order\nto fully prevent a race where this check is not reliable the error\nrecovery work must flush async_event_work before continuing to destroy\nthe admin queue after setting the ctrl state to RESETTING such that\nthere is no race .submit_async_event and the error recovery handler\nitself changing the ctrl state."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The nvme-rdma host processes RDMA completions and AENs from a remote NVMe-oF peer (InfiniBand/RoCE/iWarp); a malicious or compromised target triggers error recovery and async-event work via network protocol messages on an established connection.\nAC:L - The remote peer controls both sides of the race by sending an AEN (scheduling async_event_work) and inducing a transport error or disconnect (scheduling error_recovery_work), so success does not depend on conditions outside the attacker\u2019s influence.\nPR:N - Exploitation requires no privileges on the victim host; once an NVMe-RDMA session exists, an unauthenticated remote peer can trigger the race solely through fabric protocol behavior.\nUI:N - No additional user action is required at exploit time beyond a pre-existing NVMe-RDMA controller connection typical of datacenter storage attachments.\nS:U - The use-after-free corrupts kernel memory in the local host\u2019s NVMe-RDMA driver and does not cross a distinct security authority such as a VM or IOMMU boundary.\nC:H - Use-after-free of the admin queue async-event SQE and related queue structures enables heap reuse and arbitrary kernel read primitives.\nI:H - The same UAF is exploitable for heap spraying and arbitrary write/control-flow hijacking in kernel context.\nA:H - The UAF can cause kernel oops/panic or hangs during admin-queue teardown even without a full exploit."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/nvme/host/rdma.c"], "versions": [{"version": "7110230719602852481c2793d054f866b2bf4a2b", "lessThan": "5593f72d1922403c11749532e3a0aa4cf61414e9", "status": "affected", "versionType": "git"}, {"version": "7110230719602852481c2793d054f866b2bf4a2b", "lessThan": "d411b2a5da68b8a130c23097014434ac140a2ace", "status": "affected", "versionType": "git"}, {"version": "7110230719602852481c2793d054f866b2bf4a2b", "lessThan": "324f5bdc52ecb6a6dadb31a62823ef8c709d1439", "status": "affected", "versionType": "git"}, {"version": "7110230719602852481c2793d054f866b2bf4a2b", "lessThan": "646952b2210f19e584d2bf9eb5d092abdca2fcc1", "status": "affected", "versionType": "git"}, {"version": "7110230719602852481c2793d054f866b2bf4a2b", "lessThan": "ea86027ac467a055849c4945906f799e7f65ab99", "status": "affected", "versionType": "git"}, {"version": "7110230719602852481c2793d054f866b2bf4a2b", "lessThan": "b6bb1722f34bbdbabed27acdceaf585d300c5fd2", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/nvme/host/rdma.c"], "versions": [{"version": "4.8", "status": "affected"}, {"version": "0", "lessThan": "4.8", "status": "unaffected", "versionType": "semver"}, {"version": "4.19.231", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.181", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.102", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.25", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.16.11", "lessThanOrEqual": "5.16.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.17", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "4.19.231"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "5.4.181"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "5.10.102"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "5.15.25"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "5.16.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "5.17"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/5593f72d1922403c11749532e3a0aa4cf61414e9"}, {"url": "https://git.kernel.org/stable/c/d411b2a5da68b8a130c23097014434ac140a2ace"}, {"url": "https://git.kernel.org/stable/c/324f5bdc52ecb6a6dadb31a62823ef8c709d1439"}, {"url": "https://git.kernel.org/stable/c/646952b2210f19e584d2bf9eb5d092abdca2fcc1"}, {"url": "https://git.kernel.org/stable/c/ea86027ac467a055849c4945906f799e7f65ab99"}, {"url": "https://git.kernel.org/stable/c/b6bb1722f34bbdbabed27acdceaf585d300c5fd2"}], "title": "nvme-rdma: fix possible use-after-free in transport error_recovery work", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T15:25:00.328Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/5593f72d1922403c11749532e3a0aa4cf61414e9", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/d411b2a5da68b8a130c23097014434ac140a2ace", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/324f5bdc52ecb6a6dadb31a62823ef8c709d1439", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/646952b2210f19e584d2bf9eb5d092abdca2fcc1", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ea86027ac467a055849c4945906f799e7f65ab99", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b6bb1722f34bbdbabed27acdceaf585d300c5fd2", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-48788", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T16:59:45.973242Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:34:16.058Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/5593f72d1922403c11749532e3a0aa4cf61414e9", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/d411b2a5da68b8a130c23097014434ac140a2ace", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/324f5bdc52ecb6a6dadb31a62823ef8c709d1439", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/646952b2210f19e584d2bf9eb5d092abdca2fcc1", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ea86027ac467a055849c4945906f799e7f65ab99", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b6bb1722f34bbdbabed27acdceaf585d300c5fd2", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T15:25:00.328Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-48788", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T16:59:45.973242Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:21.680Z"}}], "cna": {"title": "nvme-rdma: fix possible use-after-free in transport error_recovery work", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The nvme-rdma host processes RDMA completions and AENs from a remote NVMe-oF peer (InfiniBand/RoCE/iWarp); a malicious or compromised target triggers error recovery and async-event work via network protocol messages on an established connection.\nAC:L - The remote peer controls both sides of the race by sending an AEN (scheduling async_event_work) and inducing a transport error or disconnect (scheduling error_recovery_work), so success does not depend on conditions outside the attacker\u2019s influence.\nPR:N - Exploitation requires no privileges on the victim host; once an NVMe-RDMA session exists, an unauthenticated remote peer can trigger the race solely through fabric protocol behavior.\nUI:N - No additional user action is required at exploit time beyond a pre-existing NVMe-RDMA controller connection typical of datacenter storage attachments.\nS:U - The use-after-free corrupts kernel memory in the local host\u2019s NVMe-RDMA driver and does not cross a distinct security authority such as a VM or IOMMU boundary.\nC:H - Use-after-free of the admin queue async-event SQE and related queue structures enables heap reuse and arbitrary kernel read primitives.\nI:H - The same UAF is exploitable for heap spraying and arbitrary write/control-flow hijacking in kernel context.\nA:H - The UAF can cause kernel oops/panic or hangs during admin-queue teardown even without a full exploit."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "7110230719602852481c2793d054f866b2bf4a2b", "lessThan": "5593f72d1922403c11749532e3a0aa4cf61414e9", "versionType": "git"}, {"status": "affected", "version": "7110230719602852481c2793d054f866b2bf4a2b", "lessThan": "d411b2a5da68b8a130c23097014434ac140a2ace", "versionType": "git"}, {"status": "affected", "version": "7110230719602852481c2793d054f866b2bf4a2b", "lessThan": "324f5bdc52ecb6a6dadb31a62823ef8c709d1439", "versionType": "git"}, {"status": "affected", "version": "7110230719602852481c2793d054f866b2bf4a2b", "lessThan": "646952b2210f19e584d2bf9eb5d092abdca2fcc1", "versionType": "git"}, {"status": "affected", "version": "7110230719602852481c2793d054f866b2bf4a2b", "lessThan": "ea86027ac467a055849c4945906f799e7f65ab99", "versionType": "git"}, {"status": "affected", "version": "7110230719602852481c2793d054f866b2bf4a2b", "lessThan": "b6bb1722f34bbdbabed27acdceaf585d300c5fd2", "versionType": "git"}], "programFiles": ["drivers/nvme/host/rdma.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.8"}, {"status": "unaffected", "version": "0", "lessThan": "4.8", "versionType": "semver"}, {"status": "unaffected", "version": "4.19.231", "versionType": "semver", "lessThanOrEqual": "4.19.*"}, {"status": "unaffected", "version": "5.4.181", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.102", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.25", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "5.16.11", "versionType": "semver", "lessThanOrEqual": "5.16.*"}, {"status": "unaffected", "version": "5.17", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/nvme/host/rdma.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/5593f72d1922403c11749532e3a0aa4cf61414e9"}, {"url": "https://git.kernel.org/stable/c/d411b2a5da68b8a130c23097014434ac140a2ace"}, {"url": "https://git.kernel.org/stable/c/324f5bdc52ecb6a6dadb31a62823ef8c709d1439"}, {"url": "https://git.kernel.org/stable/c/646952b2210f19e584d2bf9eb5d092abdca2fcc1"}, {"url": "https://git.kernel.org/stable/c/ea86027ac467a055849c4945906f799e7f65ab99"}, {"url": "https://git.kernel.org/stable/c/b6bb1722f34bbdbabed27acdceaf585d300c5fd2"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-rdma: fix possible use-after-free in transport error_recovery work\n\nWhile nvme_rdma_submit_async_event_work is checking the ctrl and queue\nstate before preparing the AER command and scheduling io_work, in order\nto fully prevent a race where this check is not reliable the error\nrecovery work must flush async_event_work before continuing to destroy\nthe admin queue after setting the ctrl state to RESETTING such that\nthere is no race .submit_async_event and the error recovery handler\nitself changing the ctrl state."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.19.231", "versionStartIncluding": "4.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.181", "versionStartIncluding": "4.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.102", "versionStartIncluding": "4.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.25", "versionStartIncluding": "4.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.16.11", "versionStartIncluding": "4.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.17", "versionStartIncluding": "4.8"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:52:18.532Z"}}}, "cveMetadata": {"cveId": "CVE-2022-48788", "state": "PUBLISHED", "dateUpdated": "2026-08-05T08:52:18.532Z", "dateReserved": "2024-07-16T11:38:08.892Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-07-16T11:43:45.213Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/nvme/host/rdma.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "5593f72d1922403c11749532e3a0aa4cf61414e9", "status": "affected", "version": "7110230719602852481c2793d054f866b2bf4a2b", "versionType": "git"}, {"lessThan": "d411b2a5da68b8a130c23097014434ac140a2ace", "status": "affected", "version": "7110230719602852481c2793d054f866b2bf4a2b", "versionType": "git"}, {"lessThan": "324f5bdc52ecb6a6dadb31a62823ef8c709d1439", "status": "affected", "version": "7110230719602852481c2793d054f866b2bf4a2b", "versionType": "git"}, {"lessThan": "646952b2210f19e584d2bf9eb5d092abdca2fcc1", "status": "affected", "version": "7110230719602852481c2793d054f866b2bf4a2b", "versionType": "git"}, {"lessThan": "ea86027ac467a055849c4945906f799e7f65ab99", "status": "affected", "version": "7110230719602852481c2793d054f866b2bf4a2b", "versionType": "git"}, {"lessThan": "b6bb1722f34bbdbabed27acdceaf585d300c5fd2", "status": "affected", "version": "7110230719602852481c2793d054f866b2bf4a2b", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/nvme/host/rdma.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.8"}, {"lessThan": "4.8", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.231", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.181", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.102", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.25", "versionType": "semver"}, {"lessThanOrEqual": "5.16.*", "status": "unaffected", "version": "5.16.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "5.17", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "BED6719E-2004-42C8-8CA4-4E4CD159B63F", "versionEndExcluding": "4.19.231", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "FB33213E-1A45-4E3B-A129-58AAA2EB921D", "versionEndExcluding": "5.4.181", "versionStartIncluding": "4.20", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "DAD66A9A-8D06-48D1-8AA8-FC060496FF53", "versionEndExcluding": "5.10.102", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D098AA16-8E21-4EB7-AE2F-1EEB58E1A3A3", "versionEndExcluding": "5.15.25", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0D327234-5D4A-43DC-A6DF-BCA0CEBEC039", "versionEndExcluding": "5.16.11", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.17:rc1:*:*:*:*:*:*", "matchCriteriaId": "7BD5F8D9-54FA-4CB0-B4F0-CB0471FDDB2D", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.17:rc2:*:*:*:*:*:*", "matchCriteriaId": "E6E34B23-78B4-4516-9BD8-61B33F4AC49A", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-rdma: fix possible use-after-free in transport error_recovery work\n\nWhile nvme_rdma_submit_async_event_work is checking the ctrl and queue\nstate before preparing the AER command and scheduling io_work, in order\nto fully prevent a race where this check is not reliable the error\nrecovery work must flush async_event_work before continuing to destroy\nthe admin queue after setting the ctrl state to RESETTING such that\nthere is no race .submit_async_event and the error recovery handler\nitself changing the ctrl state."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nvme-rdma: soluciona el posible use-after-free en el transporte error_recovery work Mientras nvme_rdma_submit_async_event_work verifica el control y el estado de la cola antes de preparar el comando AER y programar io_work, para evitar completamente una ejecuci\u00f3n donde esta verificaci\u00f3n no es confiable, el trabajo de recuperaci\u00f3n de errores debe eliminar async_event_work antes de continuar destruyendo la cola de administraci\u00f3n despu\u00e9s de configurar el estado de control en RESETTING de manera que no haya ejecuci\u00f3n .submit_async_event y el propio controlador de recuperaci\u00f3n de errores cambie el estado de control."}], "id": "CVE-2022-48788", "lastModified": "2026-08-04T10:17:21.133", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2022-48788", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:59:45.973242Z", "version": "2.0.3"}}]}, "published": "2024-07-16T12:15:03.703", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/324f5bdc52ecb6a6dadb31a62823ef8c709d1439"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5593f72d1922403c11749532e3a0aa4cf61414e9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/646952b2210f19e584d2bf9eb5d092abdca2fcc1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b6bb1722f34bbdbabed27acdceaf585d300c5fd2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d411b2a5da68b8a130c23097014434ac140a2ace"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ea86027ac467a055849c4945906f799e7f65ab99"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/324f5bdc52ecb6a6dadb31a62823ef8c709d1439"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5593f72d1922403c11749532e3a0aa4cf61414e9"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/646952b2210f19e584d2bf9eb5d092abdca2fcc1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b6bb1722f34bbdbabed27acdceaf585d300c5fd2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d411b2a5da68b8a130c23097014434ac140a2ace"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ea86027ac467a055849c4945906f799e7f65ab99"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: nvme-rdma: fix possible use-after-free in transport error_recovery work", "id": "2298124", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2298124"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnvme-rdma: fix possible use-after-free in transport error_recovery work\nWhile nvme_rdma_submit_async_event_work is checking the ctrl and queue\nstate before preparing the AER command and scheduling io_work, in order\nto fully prevent a race where this check is not reliable the error\nrecovery work must flush async_event_work before continuing to destroy\nthe admin queue after setting the ctrl state to RESETTING such that\nthere is no race .submit_async_event and the error recovery handler\nitself changing the ctrl state.", "A use after free vulnerability was found in the transport error_recovery. When nvme_rdma_submit_async is checking the ctrl and queue state before preparing the AER command and scheduling, io_work,recovery work must flush async_event_work before continuing to destroy the admin queue after setting the ctrl state to RESETTING."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2022-48788", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-07-16T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2022-48788\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-48788\nhttps://lore.kernel.org/linux-cve-announce/2024071640-CVE-2022-48788-be08@gregkh/T"], "threat_severity": "Moderate"}

{}