CVE-2022-49377
Published: 26 February 2025
Description
In the Linux kernel, the following vulnerability has been resolved: blk-mq: don't touch ->tagset in blk_mq_get_sq_hctx blk_mq_run_hw_queues() could be run when there isn't queued request and after queue is cleaned up, at that time tagset is freed, because tagset lifetime is covered by driver, and often freed after blk_cleanup_queue() returns. So don't touch ->tagset for figuring out current default hctx by the mapping built in request queue, so use-after-free on tagset can be avoided. Meantime this way should be fast than retrieving mapping from tagset.
Security Summary
CVE-2022-49377 is a use-after-free vulnerability (CWE-416) in the Linux kernel's blk-mq (block multi-queue) subsystem. The flaw arises in the blk_mq_get_sq_hctx function, which accesses the ->tagset pointer even after it may have been freed. This occurs when blk_mq_run_hw_queues is invoked without queued requests following queue cleanup via blk_cleanup_queue, as the tagset lifetime is managed by the driver and often freed post-cleanup. The vulnerability has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and affects Linux kernel versions prior to the patched releases.
A local attacker with low privileges can exploit this vulnerability with low attack complexity and no user interaction required. Exploitation involves triggering the use-after-free condition during blk-mq operations, potentially leading to high impacts on confidentiality, integrity, and availability, such as arbitrary code execution, data corruption, or kernel crashes.
Mitigation requires applying upstream patches from the Linux kernel stable repositories. Relevant fixes include commits 460aa288c5cd0544dcf933a2f0ad0e8c6d2d35ff, 5d05426e2d5fd7df8afc866b78c36b37b00188b7, 70fdd922c7bf8949f8df109cf2635dff64c90392, and b140bac470b4f707cda59c7266214246238661df, which modify blk_mq_get_sq_hctx to avoid accessing ->tagset and instead use the request queue's mapping for default hctx determination, preventing the use-after-free while maintaining performance.
Details
- CWE(s)