GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-48890 (GCVE-0-2022-48890)

Vulnerability from cvelistv5 – Published: 2024-08-21 06:10 – Updated: 2026-05-11 18:49
VLAI
Title
scsi: storvsc: Fix swiotlb bounce buffer leak in confidential VM
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: storvsc: Fix swiotlb bounce buffer leak in confidential VM storvsc_queuecommand() maps the scatter/gather list using scsi_dma_map(), which in a confidential VM allocates swiotlb bounce buffers. If the I/O submission fails in storvsc_do_io(), the I/O is typically retried by higher level code, but the bounce buffer memory is never freed. The mostly like cause of I/O submission failure is a full VMBus channel ring buffer, which is not uncommon under high I/O loads. Eventually enough bounce buffer memory leaks that the confidential VM can't do any I/O. The same problem can arise in a non-confidential VM with kernel boot parameter swiotlb=force. Fix this by doing scsi_dma_unmap() in the case of an I/O submission error, which frees the bounce buffer memory.
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 16:04 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 743b237c3a7b0f5b44aa704aae8a1058877b6322 , < 87c71e88f6a6619ffb1ff88f84dff48ef6d57adb (git)
Affected: 743b237c3a7b0f5b44aa704aae8a1058877b6322 , < 67ff3d0a49f3d445c3922e30a54e03c161da561e (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.17
Unaffected: 0 , < 5.17 (semver)
Unaffected: 6.1.7 , ≤ 6.1.* (semver)
Unaffected: 6.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-48890",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:04:25.311779Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:32:55.107Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/storvsc_drv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "87c71e88f6a6619ffb1ff88f84dff48ef6d57adb",
              "status": "affected",
              "version": "743b237c3a7b0f5b44aa704aae8a1058877b6322",
              "versionType": "git"
            },
            {
              "lessThan": "67ff3d0a49f3d445c3922e30a54e03c161da561e",
              "status": "affected",
              "version": "743b237c3a7b0f5b44aa704aae8a1058877b6322",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/storvsc_drv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.7",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: storvsc: Fix swiotlb bounce buffer leak in confidential VM\n\nstorvsc_queuecommand() maps the scatter/gather list using scsi_dma_map(),\nwhich in a confidential VM allocates swiotlb bounce buffers. If the I/O\nsubmission fails in storvsc_do_io(), the I/O is typically retried by higher\nlevel code, but the bounce buffer memory is never freed.  The mostly like\ncause of I/O submission failure is a full VMBus channel ring buffer, which\nis not uncommon under high I/O loads.  Eventually enough bounce buffer\nmemory leaks that the confidential VM can\u0027t do any I/O. The same problem\ncan arise in a non-confidential VM with kernel boot parameter\nswiotlb=force.\n\nFix this by doing scsi_dma_unmap() in the case of an I/O submission\nerror, which frees the bounce buffer memory."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T18:49:09.678Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/87c71e88f6a6619ffb1ff88f84dff48ef6d57adb"
        },
        {
          "url": "https://git.kernel.org/stable/c/67ff3d0a49f3d445c3922e30a54e03c161da561e"
        }
      ],
      "title": "scsi: storvsc: Fix swiotlb bounce buffer leak in confidential VM",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48890",
    "datePublished": "2024-08-21T06:10:22.243Z",
    "dateReserved": "2024-08-21T06:06:23.290Z",
    "dateUpdated": "2026-05-11T18:49:09.678Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-48890",
      "date": "2026-09-16",
      "epss": "0.00208",
      "percentile": "0.11168"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-48890\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-08-21T07:15:05.303\",\"lastModified\":\"2026-06-17T05:16:32.400\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nscsi: storvsc: Fix swiotlb bounce buffer leak in confidential VM\\n\\nstorvsc_queuecommand() maps the scatter/gather list using scsi_dma_map(),\\nwhich in a confidential VM allocates swiotlb bounce buffers. If the I/O\\nsubmission fails in storvsc_do_io(), the I/O is typically retried by higher\\nlevel code, but the bounce buffer memory is never freed.  The mostly like\\ncause of I/O submission failure is a full VMBus channel ring buffer, which\\nis not uncommon under high I/O loads.  Eventually enough bounce buffer\\nmemory leaks that the confidential VM can\u0027t do any I/O. The same problem\\ncan arise in a non-confidential VM with kernel boot parameter\\nswiotlb=force.\\n\\nFix this by doing scsi_dma_unmap() in the case of an I/O submission\\nerror, which frees the bounce buffer memory.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: scsi: storvsc: corrige la fuga del b\u00fafer de rebote swiotlb en una VM confidencial storvsc_queuecommand() asigna la lista de dispersi\u00f3n/recopilaci\u00f3n usando scsi_dma_map(), que en una VM confidencial asigna buffers de rebote swiotlb. Si el env\u00edo de E/S falla en storvsc_do_io(), la E/S normalmente se reintenta mediante c\u00f3digo de nivel superior, pero la memoria del b\u00fafer de rebote nunca se libera. La causa m\u00e1s com\u00fan de falla en el env\u00edo de E/S es un b\u00fafer de anillo de canal VMBus lleno, lo cual no es infrecuente bajo cargas de E/S elevadas. Con el tiempo, se pierden suficientes memorias del b\u00fafer de rebote como para que la m\u00e1quina virtual confidencial no pueda realizar ninguna E/S. El mismo problema puede surgir en una m\u00e1quina virtual no confidencial con el par\u00e1metro de arranque del kernel swiotlb=force. Solucione este problema haciendo scsi_dma_unmap() en el caso de un error de env\u00edo de E/S, lo que libera la memoria del b\u00fafer de rebote.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/scsi/storvsc_drv.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"743b237c3a7b0f5b44aa704aae8a1058877b6322\",\"lessThan\":\"87c71e88f6a6619ffb1ff88f84dff48ef6d57adb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"743b237c3a7b0f5b44aa704aae8a1058877b6322\",\"lessThan\":\"67ff3d0a49f3d445c3922e30a54e03c161da561e\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/scsi/storvsc_drv.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.17\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.17\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.7\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T16:04:25.311779Z\",\"id\":\"CVE-2022-48890\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-401\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.17\",\"versionEndExcluding\":\"6.1.7\",\"matchCriteriaId\":\"96403C94-C711-476F-BE5F-C7510379207B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"FF501633-2F44-4913-A8EE-B021929F49F6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"2BDA597B-CAC1-4DF0-86F0-42E142C654E9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"725C78C9-12CE-406F-ABE8-0813A01D66E8\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/67ff3d0a49f3d445c3922e30a54e03c161da561e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/87c71e88f6a6619ffb1ff88f84dff48ef6d57adb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2025-11-21T11:06:06+00:00",
      "cve": "CVE-2022-48890",
      "id": "CVE-2022-48890",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: scsi: storvsc: Fix swiotlb bounce buffer leak in confidential VM",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-48890.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-48890\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:04:25.311779Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:12.092Z\"}}], \"cna\": {\"title\": \"scsi: storvsc: Fix swiotlb bounce buffer leak in confidential VM\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"743b237c3a7b\", \"lessThan\": \"87c71e88f6a6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"743b237c3a7b\", \"lessThan\": \"67ff3d0a49f3\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/scsi/storvsc_drv.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.17\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.17\", \"versionType\": \"custom\"}, {\"status\": \"unaffected\", \"version\": \"6.1.7\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.2\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/scsi/storvsc_drv.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/87c71e88f6a6619ffb1ff88f84dff48ef6d57adb\"}, {\"url\": \"https://git.kernel.org/stable/c/67ff3d0a49f3d445c3922e30a54e03c161da561e\"}], \"x_generator\": {\"engine\": \"bippy-c9c4e1df01b2\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nscsi: storvsc: Fix swiotlb bounce buffer leak in confidential VM\\n\\nstorvsc_queuecommand() maps the scatter/gather list using scsi_dma_map(),\\nwhich in a confidential VM allocates swiotlb bounce buffers. If the I/O\\nsubmission fails in storvsc_do_io(), the I/O is typically retried by higher\\nlevel code, but the bounce buffer memory is never freed.  The mostly like\\ncause of I/O submission failure is a full VMBus channel ring buffer, which\\nis not uncommon under high I/O loads.  Eventually enough bounce buffer\\nmemory leaks that the confidential VM can\u0027t do any I/O. The same problem\\ncan arise in a non-confidential VM with kernel boot parameter\\nswiotlb=force.\\n\\nFix this by doing scsi_dma_unmap() in the case of an I/O submission\\nerror, which frees the bounce buffer memory.\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-08-21T06:10:22.243Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-48890\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-09-12T17:32:55.107Z\", \"dateReserved\": \"2024-08-21T06:06:23.290Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-08-21T06:10:22.243Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.