https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 23:55:51 +0000 https://db.gcve.eu/vuln/cve-2022-50563 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>dm thin: Fix UAF in run_timer_softirq()</p> <p>When dm_resume() and dm_destroy() are concurrent, it will lead to UAF, as follows:</p> <p>BUG: KASAN: use-after-free in __run_timers+0x173/0x710 Write of size 8 at addr ffff88816d9490f0 by task swapper/0/0 &lt;snip&gt; Call Trace: &lt;IRQ&gt; dump_stack_lvl+0x73/0x9f print_report.cold+0x132/0xaa2 _raw_spin_lock_irqsave+0xcd/0x160 __run_timers+0x173/0x710 kasan_report+0xad/0x110 __run_timers+0x173/0x710 __asan_store8+0x9c/0x140 __run_timers+0x173/0x710 call_timer_fn+0x310/0x310 pvclock_clocksource_read+0xfa/0x250 kvm_clock_read+0x2c/0x70 kvm_clock_get_cycles+0xd/0x20 ktime_get+0x5c/0x110 lapic_next_event+0x38/0x50 clockevents_program_event+0xf1/0x1e0 run_timer_softirq+0x49/0x90 __do_softirq+0x16e/0x62c __irq_exit_rcu+0x1fa/0x270 irq_exit_rcu+0x12/0x20 sysvec_apic_timer_interrupt+0x8e/0xc0</p> <p>One of the concurrency UAF can be shown as below:</p> <p>use free do_resume | __find_device_hash_cell | dm_get | atomic_inc(&amp;md-&gt;holders) | | dm_destroy | __dm_destroy | if (!dm_suspended_md(md)) | atomic_read(&amp;md-&gt;holders) | msleep(1) dm_resume…</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>dm thin: Fix UAF in run_timer_softirq()</p> <p>When dm_resume() and dm_destroy() are concurrent, it will lead to UAF, as follows:</p> <p>BUG: KASAN: use-after-free in __run_timers+0x173/0x710 Write of size 8 at addr ffff88816d9490f0 by task swapper/0/0 &lt;snip&gt; Call Trace: &lt;IRQ&gt; dump_stack_lvl+0x73/0x9f print_report.cold+0x132/0xaa2 _raw_spin_lock_irqsave+0xcd/0x160 __run_timers+0x173/0x710 kasan_report+0xad/0x110 __run_timers+0x173/0x710 __asan_store8+0x9c/0x140 __run_timers+0x173/0x710 call_timer_fn+0x310/0x310 pvclock_clocksource_read+0xfa/0x250 kvm_clock_read+0x2c/0x70 kvm_clock_get_cycles+0xd/0x20 ktime_get+0x5c/0x110 lapic_next_event+0x38/0x50 clockevents_program_event+0xf1/0x1e0 run_timer_softirq+0x49/0x90 __do_softirq+0x16e/0x62c __irq_exit_rcu+0x1fa/0x270 irq_exit_rcu+0x12/0x20 sysvec_apic_timer_interrupt+0x8e/0xc0</p> <p>One of the concurrency UAF can be shown as below:</p> <p>use free do_resume | __find_device_hash_cell | dm_get | atomic_inc(&amp;md-&gt;holders) | | dm_destroy | __dm_destroy | if (!dm_suspended_md(md)) | atomic_read(&amp;md-&gt;holders) | msleep(1) dm_resume…</p> https://db.gcve.eu/vuln/cve-2022-50563