{
   "containers": {
      "cna": {
         "providerMetadata": {
            "orgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038"
         },
         "descriptions": [
            {
               "lang": "en",
               "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: fastrpc: Fix use-after-free race condition for maps\n\nIt is possible that in between calling fastrpc_map_get() until\nmap->fl->lock is taken in fastrpc_free_map(), another thread can call\nfastrpc_map_lookup() and get a reference to a map that is about to be\ndeleted.\n\nRewrite fastrpc_map_get() to only increase the reference count of a map\nif it's non-zero. Propagate this to callers so they can know if a map is\nabout to be deleted.\n\nFixes this warning:\nrefcount_t: addition on 0; use-after-free.\nWARNING: CPU: 5 PID: 10100 at lib/refcount.c:25 refcount_warn_saturate\n...\nCall trace:\n refcount_warn_saturate\n [fastrpc_map_get inlined]\n [fastrpc_map_lookup inlined]\n fastrpc_map_create\n fastrpc_internal_invoke\n fastrpc_device_ioctl\n __arm64_sys_ioctl\n invoke_syscall"
            }
         ],
         "affected": [
            {
               "product": "Linux",
               "vendor": "Linux",
               "defaultStatus": "unaffected",
               "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               "programFiles": [
                  "drivers/misc/fastrpc.c"
               ],
               "versions": [
                  {
                     "version": "c68cfb718c8f",
                     "lessThan": "556dfdb226ce",
                     "status": "affected",
                     "versionType": "git"
                  },
                  {
                     "version": "c68cfb718c8f",
                     "lessThan": "b171d0d2cf1b",
                     "status": "affected",
                     "versionType": "git"
                  },
                  {
                     "version": "c68cfb718c8f",
                     "lessThan": "61a0890cb95a",
                     "status": "affected",
                     "versionType": "git"
                  },
                  {
                     "version": "c68cfb718c8f",
                     "lessThan": "079c78c68714",
                     "status": "affected",
                     "versionType": "git"
                  },
                  {
                     "version": "c68cfb718c8f",
                     "lessThan": "96b328d119ec",
                     "status": "affected",
                     "versionType": "git"
                  }
               ]
            },
            {
               "product": "Linux",
               "vendor": "Linux",
               "defaultStatus": "affected",
               "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               "programFiles": [
                  "drivers/misc/fastrpc.c"
               ],
               "versions": [
                  {
                     "version": "5.1",
                     "status": "affected"
                  },
                  {
                     "version": "0",
                     "lessThan": "5.1",
                     "status": "unaffected",
                     "versionType": "custom"
                  },
                  {
                     "version": "5.4.230",
                     "lessThanOrEqual": "5.4.*",
                     "status": "unaffected",
                     "versionType": "custom"
                  },
                  {
                     "version": "5.10.165",
                     "lessThanOrEqual": "5.10.*",
                     "status": "unaffected",
                     "versionType": "custom"
                  },
                  {
                     "version": "5.15.90",
                     "lessThanOrEqual": "5.15.*",
                     "status": "unaffected",
                     "versionType": "custom"
                  },
                  {
                     "version": "6.1.8",
                     "lessThanOrEqual": "6.1.*",
                     "status": "unaffected",
                     "versionType": "custom"
                  },
                  {
                     "version": "6.2",
                     "lessThanOrEqual": "*",
                     "status": "unaffected",
                     "versionType": "original_commit_for_fix"
                  }
               ]
            }
         ],
         "references": [
            {
               "url": "https://git.kernel.org/stable/c/556dfdb226ce1e5231d8836159b23f8bb0395bf4"
            },
            {
               "url": "https://git.kernel.org/stable/c/b171d0d2cf1b8387c72c8d325c5d5746fa271e39"
            },
            {
               "url": "https://git.kernel.org/stable/c/61a0890cb95afec5c8a2f4a879de2b6220984ef1"
            },
            {
               "url": "https://git.kernel.org/stable/c/079c78c68714f7d8d58e66c477b0243b31806907"
            },
            {
               "url": "https://git.kernel.org/stable/c/96b328d119eca7563c1edcc4e1039a62e6370ecb"
            }
         ],
         "title": "misc: fastrpc: Fix use-after-free race condition for maps",
         "x_generator": {
            "engine": "bippy-c9c4e1df01b2"
         }
      }
   },
   "cveMetadata": {
      "assignerOrgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038",
      "cveID": "CVE-2022-48872",
      "requesterUserId": "gregkh@kernel.org",
      "serial": "1",
      "state": "PUBLISHED"
   },
   "dataType": "CVE_RECORD",
   "dataVersion": "5.0"
}