| Vulnerability Name: | CVE-2022-39188 (CCN-234979) | ||||||||||||||||||||||||||||||||
| Assigned: | 2022-07-06 | ||||||||||||||||||||||||||||||||
| Published: | 2022-07-06 | ||||||||||||||||||||||||||||||||
| Updated: | 2022-11-21 | ||||||||||||||||||||||||||||||||
| Summary: | An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race condition (unmap_mapping_range versus munmap), a device driver can free a page while it still has stale TLB entries. This only occurs in situations with VM_PFNMAP VMAs. | ||||||||||||||||||||||||||||||||
| CVSS v3 Severity: | 4.7 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) 4.1 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)
4.1 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)
| ||||||||||||||||||||||||||||||||
| CVSS v2 Severity: | 3.8 Low (CCN CVSS v2 Vector: AV:L/AC:H/Au:S/C:N/I:N/A:C)
| ||||||||||||||||||||||||||||||||
| Vulnerability Type: | CWE-362 | ||||||||||||||||||||||||||||||||
| Vulnerability Consequences: | Denial of Service | ||||||||||||||||||||||||||||||||
| References: | Source: MITRE Type: CNA CVE-2022-39188 Source: MISC Type: Issue Tracking, Patch, Third Party Advisory https://bugs.chromium.org/p/project-zero/issues/detail?id=2329 Source: CCN Type: Google Security Research Issue 2329 Issue 2329: Linux: unmap_mapping_range() race with munmap() on VM_PFNMAP mappings leads to stale TLB entry Source: MISC Type: Patch, Release Notes, Vendor Advisory https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.19 Source: XF Type: UNKNOWN linux-kernel-cve202239188-dos(234979) Source: MISC Type: Patch, Vendor Advisory https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b67fbebd4cf980aecbcc750e1462128bffe8ae15 Source: CCN Type: Linux Kernel GIT Repository mmu_gather: Force tlb-flush VM_PFNMAP vmas Source: MISC Type: Patch, Third Party Advisory https://github.com/torvalds/linux/commit/b67fbebd4cf980aecbcc750e1462128bffe8ae15 Source: MLIST Type: Mailing List, Third Party Advisory [debian-lts-announce] 20221002 [SECURITY] [DLA 3131-1] linux security update Source: MLIST Type: Mailing List, Third Party Advisory [debian-lts-announce] 20221101 [SECURITY] [DLA 3173-1] linux-5.10 security update Source: MISC Type: Mailing List, Patch, Vendor Advisory https://lore.kernel.org/stable/CAG48ez3SEqOPcPCYGHVZv4iqEApujD5VtM3Re-tCKLDEFdEdbg@mail.gmail.com/ Source: DEBIAN Type: Third Party Advisory DSA-5257 Source: CCN Type: IBM Security Bulletin 7007837 (Cloud Pak for Watson AIOps) Multiple Vulnerabilities in CloudPak for Watson AIOPs Source: CCN Type: Mend Vulnerability Database CVE-2022-39188 | ||||||||||||||||||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration 2: Configuration 3: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||||||||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||||||||||||||
| |||||||||||||||||||||||||||||||||
| BACK | |||||||||||||||||||||||||||||||||