CVE-2022-48791

scsi: pm8001: Fix use-after-free for aborted TMF sas_task

State: Published
Severity: 7.8 High
Published: Jul 16, 2024
Updated: Aug 5, 2026
Reserved: Jul 16, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: pm8001: Fix use-after-free for aborted TMF sas_task

Currently a use-after-free may occur if a TMF sas_task is aborted before we handle the IO completion in mpi_ssp_completion(). The abort occurs due to timeout.

When the timeout occurs, the SAS_TASK_STATE_ABORTED flag is set and the sas_task is freed in pm8001_exec_internal_tmf_task().

However, if the I/O completion occurs later, the I/O completion still thinks that the sas_task is available. Fix this by clearing the ccb->task if the TMF times out - the I/O completion handler does nothing if this pointer is cleared.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	968ee9176a4489ce6d5ee54ff88dadfbff9b95f4 to before d872e7b5fe38f325f5206b6872746fa02c2b4819Affected d712d3fb484b7fa8d1d57e9ca6f134bb9d8c18b1 to before 3c334cdfd94945b8edb94022a0371a8665b17366Affected d712d3fb484b7fa8d1d57e9ca6f134bb9d8c18b1 to before 510b21442c3a2e3ecc071ba3e666b320e7acdd61Affected d712d3fb484b7fa8d1d57e9ca6f134bb9d8c18b1 to before 61f162aa4381845acbdc7f2be4dfb694d027c018Affected fa3c19ceaa8b4b7c29d710c2c407df57d256a6c5Affected 5.10.61 to before 5.10.102Affected 5.13.13 to before 5.14Affected
LinuxLinux	5.14Affected before 5.14Not affected 5.10.102 through 5.10.Not affected 5.15.25 through 5.15.Not affected 5.16.11 through 5.16.*Not affected 5.17 and laterNot affected

Product

Versions

LinuxLinux

968ee9176a4489ce6d5ee54ff88dadfbff9b95f4 to before d872e7b5fe38f325f5206b6872746fa02c2b4819Affected
d712d3fb484b7fa8d1d57e9ca6f134bb9d8c18b1 to before 3c334cdfd94945b8edb94022a0371a8665b17366Affected
d712d3fb484b7fa8d1d57e9ca6f134bb9d8c18b1 to before 510b21442c3a2e3ecc071ba3e666b320e7acdd61Affected
d712d3fb484b7fa8d1d57e9ca6f134bb9d8c18b1 to before 61f162aa4381845acbdc7f2be4dfb694d027c018Affected
fa3c19ceaa8b4b7c29d710c2c407df57d256a6c5Affected
5.10.61 to before 5.10.102Affected
5.13.13 to before 5.14Affected

LinuxLinux

5.14Affected
before 5.14Not affected
5.10.102 through 5.10.*Not affected
5.15.25 through 5.15.*Not affected
5.16.11 through 5.16.*Not affected
5.17 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.