GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-48913 (GCVE-0-2022-48913)

Vulnerability from cvelistv5 – Published: 2024-08-22 01:31 – Updated: 2026-08-05 08:52
VLAI
Title
blktrace: fix use after free for struct blk_trace
Summary
In the Linux kernel, the following vulnerability has been resolved: blktrace: fix use after free for struct blk_trace When tracing the whole disk, 'dropped' and 'msg' will be created under 'q->debugfs_dir' and 'bt->dir' is NULL, thus blk_trace_free() won't remove those files. What's worse, the following UAF can be triggered because of accessing stale 'dropped' and 'msg': ================================================================== BUG: KASAN: use-after-free in blk_dropped_read+0x89/0x100 Read of size 4 at addr ffff88816912f3d8 by task blktrace/1188 CPU: 27 PID: 1188 Comm: blktrace Not tainted 5.17.0-rc4-next-20220217+ #469 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-4 Call Trace: <TASK> dump_stack_lvl+0x34/0x44 print_address_description.constprop.0.cold+0xab/0x381 ? blk_dropped_read+0x89/0x100 ? blk_dropped_read+0x89/0x100 kasan_report.cold+0x83/0xdf ? blk_dropped_read+0x89/0x100 kasan_check_range+0x140/0x1b0 blk_dropped_read+0x89/0x100 ? blk_create_buf_file_callback+0x20/0x20 ? kmem_cache_free+0xa1/0x500 ? do_sys_openat2+0x258/0x460 full_proxy_read+0x8f/0xc0 vfs_read+0xc6/0x260 ksys_read+0xb9/0x150 ? vfs_write+0x3d0/0x3d0 ? fpregs_assert_state_consistent+0x55/0x60 ? exit_to_user_mode_prepare+0x39/0x1e0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7fbc080d92fd Code: ce 20 00 00 75 10 b8 00 00 00 00 0f 05 48 3d 01 f0 ff ff 73 31 c3 48 83 1 RSP: 002b:00007fbb95ff9cb0 EFLAGS: 00000293 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 00007fbb95ff9dc0 RCX: 00007fbc080d92fd RDX: 0000000000000100 RSI: 00007fbb95ff9cc0 RDI: 0000000000000045 RBP: 0000000000000045 R08: 0000000000406299 R09: 00000000fffffffd R10: 000000000153afa0 R11: 0000000000000293 R12: 00007fbb780008c0 R13: 00007fbb78000938 R14: 0000000000608b30 R15: 00007fbb780029c8 </TASK> Allocated by task 1050: kasan_save_stack+0x1e/0x40 __kasan_kmalloc+0x81/0xa0 do_blk_trace_setup+0xcb/0x410 __blk_trace_setup+0xac/0x130 blk_trace_ioctl+0xe9/0x1c0 blkdev_ioctl+0xf1/0x390 __x64_sys_ioctl+0xa5/0xe0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae Freed by task 1050: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_set_free_info+0x20/0x30 __kasan_slab_free+0x103/0x180 kfree+0x9a/0x4c0 __blk_trace_remove+0x53/0x70 blk_trace_ioctl+0x199/0x1c0 blkdev_common_ioctl+0x5e9/0xb30 blkdev_ioctl+0x1a5/0x390 __x64_sys_ioctl+0xa5/0xe0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae The buggy address belongs to the object at ffff88816912f380 which belongs to the cache kmalloc-96 of size 96 The buggy address is located 88 bytes inside of 96-byte region [ffff88816912f380, ffff88816912f3e0) The buggy address belongs to the page: page:000000009a1b4e7c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0f flags: 0x17ffffc0000200(slab|node=0|zone=2|lastcpupid=0x1fffff) raw: 0017ffffc0000200 ffffea00044f1100 dead000000000002 ffff88810004c780 raw: 0000000000000000 0000000000200020 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88816912f280: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ffff88816912f300: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc >ffff88816912f380: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ^ ffff88816912f400: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ffff88816912f480: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ==================================================================
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 15:33 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: c0ea57608b691d6cde8aff23e11f9858a86b5918 , < 78acc7dbd84a8c173a08584750845c31611160f2 (git)
Affected: c0ea57608b691d6cde8aff23e11f9858a86b5918 , < 6418634238ade86f2b08192928787f39d8afb58c (git)
Affected: c0ea57608b691d6cde8aff23e11f9858a86b5918 , < 30939293262eb433c960c4532a0d59c4073b2b84 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.12
Unaffected: 0 , < 5.12 (semver)
Unaffected: 5.15.27 , ≤ 5.15.* (semver)
Unaffected: 5.16.13 , ≤ 5.16.* (semver)
Unaffected: 5.17 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-48913",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:33:53.963718Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:33:11.780Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/blktrace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "78acc7dbd84a8c173a08584750845c31611160f2",
              "status": "affected",
              "version": "c0ea57608b691d6cde8aff23e11f9858a86b5918",
              "versionType": "git"
            },
            {
              "lessThan": "6418634238ade86f2b08192928787f39d8afb58c",
              "status": "affected",
              "version": "c0ea57608b691d6cde8aff23e11f9858a86b5918",
              "versionType": "git"
            },
            {
              "lessThan": "30939293262eb433c960c4532a0d59c4073b2b84",
              "status": "affected",
              "version": "c0ea57608b691d6cde8aff23e11f9858a86b5918",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/blktrace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "lessThan": "5.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.27",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.27",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16.13",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblktrace: fix use after free for struct blk_trace\n\nWhen tracing the whole disk, \u0027dropped\u0027 and \u0027msg\u0027 will be created\nunder \u0027q-\u003edebugfs_dir\u0027 and \u0027bt-\u003edir\u0027 is NULL, thus blk_trace_free()\nwon\u0027t remove those files. What\u0027s worse, the following UAF can be\ntriggered because of accessing stale \u0027dropped\u0027 and \u0027msg\u0027:\n\n==================================================================\nBUG: KASAN: use-after-free in blk_dropped_read+0x89/0x100\nRead of size 4 at addr ffff88816912f3d8 by task blktrace/1188\n\nCPU: 27 PID: 1188 Comm: blktrace Not tainted 5.17.0-rc4-next-20220217+ #469\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-4\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x34/0x44\n print_address_description.constprop.0.cold+0xab/0x381\n ? blk_dropped_read+0x89/0x100\n ? blk_dropped_read+0x89/0x100\n kasan_report.cold+0x83/0xdf\n ? blk_dropped_read+0x89/0x100\n kasan_check_range+0x140/0x1b0\n blk_dropped_read+0x89/0x100\n ? blk_create_buf_file_callback+0x20/0x20\n ? kmem_cache_free+0xa1/0x500\n ? do_sys_openat2+0x258/0x460\n full_proxy_read+0x8f/0xc0\n vfs_read+0xc6/0x260\n ksys_read+0xb9/0x150\n ? vfs_write+0x3d0/0x3d0\n ? fpregs_assert_state_consistent+0x55/0x60\n ? exit_to_user_mode_prepare+0x39/0x1e0\n do_syscall_64+0x35/0x80\n entry_SYSCALL_64_after_hwframe+0x44/0xae\nRIP: 0033:0x7fbc080d92fd\nCode: ce 20 00 00 75 10 b8 00 00 00 00 0f 05 48 3d 01 f0 ff ff 73 31 c3 48 83 1\nRSP: 002b:00007fbb95ff9cb0 EFLAGS: 00000293 ORIG_RAX: 0000000000000000\nRAX: ffffffffffffffda RBX: 00007fbb95ff9dc0 RCX: 00007fbc080d92fd\nRDX: 0000000000000100 RSI: 00007fbb95ff9cc0 RDI: 0000000000000045\nRBP: 0000000000000045 R08: 0000000000406299 R09: 00000000fffffffd\nR10: 000000000153afa0 R11: 0000000000000293 R12: 00007fbb780008c0\nR13: 00007fbb78000938 R14: 0000000000608b30 R15: 00007fbb780029c8\n \u003c/TASK\u003e\n\nAllocated by task 1050:\n kasan_save_stack+0x1e/0x40\n __kasan_kmalloc+0x81/0xa0\n do_blk_trace_setup+0xcb/0x410\n __blk_trace_setup+0xac/0x130\n blk_trace_ioctl+0xe9/0x1c0\n blkdev_ioctl+0xf1/0x390\n __x64_sys_ioctl+0xa5/0xe0\n do_syscall_64+0x35/0x80\n entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nFreed by task 1050:\n kasan_save_stack+0x1e/0x40\n kasan_set_track+0x21/0x30\n kasan_set_free_info+0x20/0x30\n __kasan_slab_free+0x103/0x180\n kfree+0x9a/0x4c0\n __blk_trace_remove+0x53/0x70\n blk_trace_ioctl+0x199/0x1c0\n blkdev_common_ioctl+0x5e9/0xb30\n blkdev_ioctl+0x1a5/0x390\n __x64_sys_ioctl+0xa5/0xe0\n do_syscall_64+0x35/0x80\n entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nThe buggy address belongs to the object at ffff88816912f380\n which belongs to the cache kmalloc-96 of size 96\nThe buggy address is located 88 bytes inside of\n 96-byte region [ffff88816912f380, ffff88816912f3e0)\nThe buggy address belongs to the page:\npage:000000009a1b4e7c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0f\nflags: 0x17ffffc0000200(slab|node=0|zone=2|lastcpupid=0x1fffff)\nraw: 0017ffffc0000200 ffffea00044f1100 dead000000000002 ffff88810004c780\nraw: 0000000000000000 0000000000200020 00000001ffffffff 0000000000000000\npage dumped because: kasan: bad access detected\n\nMemory state around the buggy address:\n ffff88816912f280: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc\n ffff88816912f300: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc\n\u003effff88816912f380: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc\n                                                    ^\n ffff88816912f400: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc\n ffff88816912f480: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc\n=================================================================="
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only via local blkdev ioctls (BLKTRACESETUP/BLKTRACETEARDOWN) and subsequent read/write of the blktrace debugfs files under /sys/kernel/debug/block/; it is not reachable from the network stack or remote protocols.\nAC:L - The attacker fully controls setup, opening the debugfs files, teardown, and the later UAF access; the failure is a missing cleanup for whole-disk traces (bt-\u003edir NULL), not a race or other condition outside attacker control.\nPR:L - blk_trace_ioctl has no capable() gate and is reachable by any process that can open a whole-disk block device and the created debugfs nodes; that is basic elevated local access (e.g. disk-group or similarly permitted device access), not an init-namespace-only CAP_SYS_ADMIN check.\nUI:N - The attacker performs setup, teardown, and the debugfs read/write themselves; no separate victim action is required.\nS:U - A successful exploit corrupts kernel memory and can escalate within the same OS/kernel authority; it does not cross a VM, IOMMU, or other security-authority boundary.\nC:H - This is a use-after-free of struct blk_trace (kmalloc-96); blk_dropped_read dereferences the freed object, and with heap spray the UAF yields a strong arbitrary-read primitive.\nI:H - blk_msg_write invokes __trace_note_message on the freed blk_trace, using attacker-sprayable fields (act_mask, msg_data, rchan) that can be turned into arbitrary writes and control-flow hijacking.\nA:H - Any use of the dangling dropped/msg file after teardown can oops/panic the kernel via the UAF, so availability impact is high even without full exploitation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:52:53.708Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/78acc7dbd84a8c173a08584750845c31611160f2"
        },
        {
          "url": "https://git.kernel.org/stable/c/6418634238ade86f2b08192928787f39d8afb58c"
        },
        {
          "url": "https://git.kernel.org/stable/c/30939293262eb433c960c4532a0d59c4073b2b84"
        }
      ],
      "title": "blktrace: fix use after free for struct blk_trace",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48913",
    "datePublished": "2024-08-22T01:31:34.860Z",
    "dateReserved": "2024-08-21T06:06:23.294Z",
    "dateUpdated": "2026-08-05T08:52:53.708Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-48913",
      "date": "2026-09-16",
      "epss": "0.00212",
      "percentile": "0.11657"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-48913\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-08-22T02:15:05.613\",\"lastModified\":\"2026-08-04T10:17:26.267\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nblktrace: fix use after free for struct blk_trace\\n\\nWhen tracing the whole disk, \u0027dropped\u0027 and \u0027msg\u0027 will be created\\nunder \u0027q-\u003edebugfs_dir\u0027 and \u0027bt-\u003edir\u0027 is NULL, thus blk_trace_free()\\nwon\u0027t remove those files. What\u0027s worse, the following UAF can be\\ntriggered because of accessing stale \u0027dropped\u0027 and \u0027msg\u0027:\\n\\n==================================================================\\nBUG: KASAN: use-after-free in blk_dropped_read+0x89/0x100\\nRead of size 4 at addr ffff88816912f3d8 by task blktrace/1188\\n\\nCPU: 27 PID: 1188 Comm: blktrace Not tainted 5.17.0-rc4-next-20220217+ #469\\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-4\\nCall Trace:\\n \u003cTASK\u003e\\n dump_stack_lvl+0x34/0x44\\n print_address_description.constprop.0.cold+0xab/0x381\\n ? blk_dropped_read+0x89/0x100\\n ? blk_dropped_read+0x89/0x100\\n kasan_report.cold+0x83/0xdf\\n ? blk_dropped_read+0x89/0x100\\n kasan_check_range+0x140/0x1b0\\n blk_dropped_read+0x89/0x100\\n ? blk_create_buf_file_callback+0x20/0x20\\n ? kmem_cache_free+0xa1/0x500\\n ? do_sys_openat2+0x258/0x460\\n full_proxy_read+0x8f/0xc0\\n vfs_read+0xc6/0x260\\n ksys_read+0xb9/0x150\\n ? vfs_write+0x3d0/0x3d0\\n ? fpregs_assert_state_consistent+0x55/0x60\\n ? exit_to_user_mode_prepare+0x39/0x1e0\\n do_syscall_64+0x35/0x80\\n entry_SYSCALL_64_after_hwframe+0x44/0xae\\nRIP: 0033:0x7fbc080d92fd\\nCode: ce 20 00 00 75 10 b8 00 00 00 00 0f 05 48 3d 01 f0 ff ff 73 31 c3 48 83 1\\nRSP: 002b:00007fbb95ff9cb0 EFLAGS: 00000293 ORIG_RAX: 0000000000000000\\nRAX: ffffffffffffffda RBX: 00007fbb95ff9dc0 RCX: 00007fbc080d92fd\\nRDX: 0000000000000100 RSI: 00007fbb95ff9cc0 RDI: 0000000000000045\\nRBP: 0000000000000045 R08: 0000000000406299 R09: 00000000fffffffd\\nR10: 000000000153afa0 R11: 0000000000000293 R12: 00007fbb780008c0\\nR13: 00007fbb78000938 R14: 0000000000608b30 R15: 00007fbb780029c8\\n \u003c/TASK\u003e\\n\\nAllocated by task 1050:\\n kasan_save_stack+0x1e/0x40\\n __kasan_kmalloc+0x81/0xa0\\n do_blk_trace_setup+0xcb/0x410\\n __blk_trace_setup+0xac/0x130\\n blk_trace_ioctl+0xe9/0x1c0\\n blkdev_ioctl+0xf1/0x390\\n __x64_sys_ioctl+0xa5/0xe0\\n do_syscall_64+0x35/0x80\\n entry_SYSCALL_64_after_hwframe+0x44/0xae\\n\\nFreed by task 1050:\\n kasan_save_stack+0x1e/0x40\\n kasan_set_track+0x21/0x30\\n kasan_set_free_info+0x20/0x30\\n __kasan_slab_free+0x103/0x180\\n kfree+0x9a/0x4c0\\n __blk_trace_remove+0x53/0x70\\n blk_trace_ioctl+0x199/0x1c0\\n blkdev_common_ioctl+0x5e9/0xb30\\n blkdev_ioctl+0x1a5/0x390\\n __x64_sys_ioctl+0xa5/0xe0\\n do_syscall_64+0x35/0x80\\n entry_SYSCALL_64_after_hwframe+0x44/0xae\\n\\nThe buggy address belongs to the object at ffff88816912f380\\n which belongs to the cache kmalloc-96 of size 96\\nThe buggy address is located 88 bytes inside of\\n 96-byte region [ffff88816912f380, ffff88816912f3e0)\\nThe buggy address belongs to the page:\\npage:000000009a1b4e7c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0f\\nflags: 0x17ffffc0000200(slab|node=0|zone=2|lastcpupid=0x1fffff)\\nraw: 0017ffffc0000200 ffffea00044f1100 dead000000000002 ffff88810004c780\\nraw: 0000000000000000 0000000000200020 00000001ffffffff 0000000000000000\\npage dumped because: kasan: bad access detected\\n\\nMemory state around the buggy address:\\n ffff88816912f280: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc\\n ffff88816912f300: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc\\n\u003effff88816912f380: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc\\n                                                    ^\\n ffff88816912f400: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc\\n ffff88816912f480: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc\\n==================================================================\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: blktrace: corrige el use after free para struct blk_trace Al rastrear todo el disco, se crear\u00e1n \u0027dropped\u0027 y \u0027msg\u0027 en \u0027q-\u0026gt;debugfs_dir\u0027 y \u0027bt-\u0026gt;dir \u0027 es NULL, por lo tanto blk_trace_free() no eliminar\u00e1 esos archivos. Lo que es peor, el siguiente UAF se puede activar debido al acceso a \u0027soltado\u0027 y \u0027msg\u0027 obsoletos: ============================== ===================================== ERROR: KASAN: use after free en blk_dropped_read+0x89 /0x100 Lectura de tama\u00f1o 4 en la direcci\u00f3n ffff88816912f3d8 por tarea blktrace/1188 CPU: 27 PID: 1188 Comm: blktrace Not tainted 5.17.0-rc4-next-20220217+ #469 Nombre de hardware: PC est\u00e1ndar QEMU (i440FX + PIIX, 1996) , BIOS ?-20190727_073836-4 Seguimiento de llamadas:  dump_stack_lvl+0x34/0x44 print_address_description.constprop.0.cold+0xab/0x381 ? blk_dropped_read+0x89/0x100? blk_dropped_read+0x89/0x100 kasan_report.cold+0x83/0xdf ? blk_dropped_read+0x89/0x100 kasan_check_range+0x140/0x1b0 blk_dropped_read+0x89/0x100 ? blk_create_buf_file_callback+0x20/0x20? kmem_cache_free+0xa1/0x500 ? do_sys_openat2+0x258/0x460 full_proxy_read+0x8f/0xc0 vfs_read+0xc6/0x260 ksys_read+0xb9/0x150 ? vfs_write+0x3d0/0x3d0? fpregs_assert_state_consistent+0x55/0x60? exit_to_user_mode_prepare+0x39/0x1e0 do_syscall_64+0x35/0x80 Entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7fbc080d92fd C\u00f3digo: ce 20 00 00 75 10 b8 00 00 00 00 0f 5 48 3d 01 f0 ff ff 73 31 c3 48 83 1 RSP: 002b :00007fbb95ff9cb0 EFLAGS: 00000293 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 00007fbb95ff9dc0 RCX: 00007fbc080d92fd RDX: 0000000000000100 R SI: 00007fbb95ff9cc0 RDI: 0000000000000045 RBP: 0000000000000045 R08: 0000000000406299 R09: 00000000fffffffd R10: 000000000153afa0 R11: 000000000293 R12: 00007fbb780008c0 R13: 00007fbb78000938 R14: 0000000000608b30 R15: 00007fbb780029c8  Asignado por tarea 1050: kasan_save_stack+0x1e/0x40 __kasan_kmalloc+0x81/0xa0 do_blk_trace_setup+0xcb/0x410 __blk_trace_setup+0xac/0x130 e9/0x1c0 blkdev_ioctl+0xf1/0x390 __x64_sys_ioctl+0xa5/0xe0 do_syscall_64+0x35 /0x80 Entry_SYSCALL_64_after_hwframe+0x44/0xae Liberado por la tarea 1050: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_set_free_info+0x20/0x30 __kasan_slab_free+0x103/0x180 kfree+0x9a/0x4c 0 __blk_trace_remove+0x53/0x70 blk_trace_ioctl+0x199/0x1c0 blkdev_common_ioctl+0x5e9 /0xb30 blkdev_ioctl+0x1a5/0x390 __x64_sys_ioctl+0xa5/0xe0 do_syscall_64+0x35/0x80 Entry_SYSCALL_64_after_hwframe+0x44/0xae La direcci\u00f3n con errores pertenece al objeto en ffff88816912f380 que pertenece al cach\u00e9 kmalloc- 96 de tama\u00f1o 96 La direcci\u00f3n del error se encuentra 88 bytes dentro de regi\u00f3n de 96 bytes [ffff88816912f380, ffff88816912f3e0) La direcci\u00f3n con errores pertenece a la p\u00e1gina: p\u00e1gina:000000009a1b4e7c refcount:1 mapcount:0 mapeo:00000000000000000 \u00edndice:0x0f banderas: 0x17ffffc0000200(slab|node= 0|zona=2|\u00faltimopupid=0x1fffff ) sin procesar: 0017ffffc0000200 ffffea00044f1100 muerto000000000002 ffff88810004c780 sin procesar: 0000000000000000 0000000000200020 00000001ffffffff 000000000000 0000 p\u00e1gina volcada porque: kasan: mal acceso detectado Estado de la memoria alrededor de la direcci\u00f3n con errores: ffff88816912f280: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ffff88816912f300: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc \u0026gt;ffff88816912f380: fa fb fb fb fb fb fb fb fb fb fb fc fc fc fc ^ ffff88816912f400: fa fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ffff88816912f480: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc =============================== =======================================\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"kernel/trace/blktrace.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"c0ea57608b691d6cde8aff23e11f9858a86b5918\",\"lessThan\":\"78acc7dbd84a8c173a08584750845c31611160f2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c0ea57608b691d6cde8aff23e11f9858a86b5918\",\"lessThan\":\"6418634238ade86f2b08192928787f39d8afb58c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c0ea57608b691d6cde8aff23e11f9858a86b5918\",\"lessThan\":\"30939293262eb433c960c4532a0d59c4073b2b84\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"kernel/trace/blktrace.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.27\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.16.13\",\"lessThanOrEqual\":\"5.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.17\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T15:33:53.963718Z\",\"id\":\"CVE-2022-48913\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.12\",\"versionEndExcluding\":\"5.15.27\",\"matchCriteriaId\":\"0124F44D-3165-4025-A6AD-1C47145E6B2A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.16.13\",\"matchCriteriaId\":\"B871B667-EDC0-435D-909E-E918D8D90995\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/30939293262eb433c960c4532a0d59c4073b2b84\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6418634238ade86f2b08192928787f39d8afb58c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/78acc7dbd84a8c173a08584750845c31611160f2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:47:37+00:00",
      "cve": "CVE-2022-48913",
      "id": "CVE-2022-48913",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: blktrace: fix use after free for struct blk_trace",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-48913.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-48913\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T15:33:53.963718Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:15.859Z\"}}], \"cna\": {\"title\": \"blktrace: fix use after free for struct blk_trace\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The bug is reached only via local blkdev ioctls (BLKTRACESETUP/BLKTRACETEARDOWN) and subsequent read/write of the blktrace debugfs files under /sys/kernel/debug/block/; it is not reachable from the network stack or remote protocols.\\nAC:L - The attacker fully controls setup, opening the debugfs files, teardown, and the later UAF access; the failure is a missing cleanup for whole-disk traces (bt-\u003edir NULL), not a race or other condition outside attacker control.\\nPR:L - blk_trace_ioctl has no capable() gate and is reachable by any process that can open a whole-disk block device and the created debugfs nodes; that is basic elevated local access (e.g. disk-group or similarly permitted device access), not an init-namespace-only CAP_SYS_ADMIN check.\\nUI:N - The attacker performs setup, teardown, and the debugfs read/write themselves; no separate victim action is required.\\nS:U - A successful exploit corrupts kernel memory and can escalate within the same OS/kernel authority; it does not cross a VM, IOMMU, or other security-authority boundary.\\nC:H - This is a use-after-free of struct blk_trace (kmalloc-96); blk_dropped_read dereferences the freed object, and with heap spray the UAF yields a strong arbitrary-read primitive.\\nI:H - blk_msg_write invokes __trace_note_message on the freed blk_trace, using attacker-sprayable fields (act_mask, msg_data, rchan) that can be turned into arbitrary writes and control-flow hijacking.\\nA:H - Any use of the dangling dropped/msg file after teardown can oops/panic the kernel via the UAF, so availability impact is high even without full exploitation.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"c0ea57608b691d6cde8aff23e11f9858a86b5918\", \"lessThan\": \"78acc7dbd84a8c173a08584750845c31611160f2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c0ea57608b691d6cde8aff23e11f9858a86b5918\", \"lessThan\": \"6418634238ade86f2b08192928787f39d8afb58c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c0ea57608b691d6cde8aff23e11f9858a86b5918\", \"lessThan\": \"30939293262eb433c960c4532a0d59c4073b2b84\", \"versionType\": \"git\"}], \"programFiles\": [\"kernel/trace/blktrace.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.12\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.12\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.27\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"5.16.13\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.16.*\"}, {\"status\": \"unaffected\", \"version\": \"5.17\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"kernel/trace/blktrace.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/78acc7dbd84a8c173a08584750845c31611160f2\"}, {\"url\": \"https://git.kernel.org/stable/c/6418634238ade86f2b08192928787f39d8afb58c\"}, {\"url\": \"https://git.kernel.org/stable/c/30939293262eb433c960c4532a0d59c4073b2b84\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nblktrace: fix use after free for struct blk_trace\\n\\nWhen tracing the whole disk, \u0027dropped\u0027 and \u0027msg\u0027 will be created\\nunder \u0027q-\u003edebugfs_dir\u0027 and \u0027bt-\u003edir\u0027 is NULL, thus blk_trace_free()\\nwon\u0027t remove those files. What\u0027s worse, the following UAF can be\\ntriggered because of accessing stale \u0027dropped\u0027 and \u0027msg\u0027:\\n\\n==================================================================\\nBUG: KASAN: use-after-free in blk_dropped_read+0x89/0x100\\nRead of size 4 at addr ffff88816912f3d8 by task blktrace/1188\\n\\nCPU: 27 PID: 1188 Comm: blktrace Not tainted 5.17.0-rc4-next-20220217+ #469\\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-4\\nCall Trace:\\n \u003cTASK\u003e\\n dump_stack_lvl+0x34/0x44\\n print_address_description.constprop.0.cold+0xab/0x381\\n ? blk_dropped_read+0x89/0x100\\n ? blk_dropped_read+0x89/0x100\\n kasan_report.cold+0x83/0xdf\\n ? blk_dropped_read+0x89/0x100\\n kasan_check_range+0x140/0x1b0\\n blk_dropped_read+0x89/0x100\\n ? blk_create_buf_file_callback+0x20/0x20\\n ? kmem_cache_free+0xa1/0x500\\n ? do_sys_openat2+0x258/0x460\\n full_proxy_read+0x8f/0xc0\\n vfs_read+0xc6/0x260\\n ksys_read+0xb9/0x150\\n ? vfs_write+0x3d0/0x3d0\\n ? fpregs_assert_state_consistent+0x55/0x60\\n ? exit_to_user_mode_prepare+0x39/0x1e0\\n do_syscall_64+0x35/0x80\\n entry_SYSCALL_64_after_hwframe+0x44/0xae\\nRIP: 0033:0x7fbc080d92fd\\nCode: ce 20 00 00 75 10 b8 00 00 00 00 0f 05 48 3d 01 f0 ff ff 73 31 c3 48 83 1\\nRSP: 002b:00007fbb95ff9cb0 EFLAGS: 00000293 ORIG_RAX: 0000000000000000\\nRAX: ffffffffffffffda RBX: 00007fbb95ff9dc0 RCX: 00007fbc080d92fd\\nRDX: 0000000000000100 RSI: 00007fbb95ff9cc0 RDI: 0000000000000045\\nRBP: 0000000000000045 R08: 0000000000406299 R09: 00000000fffffffd\\nR10: 000000000153afa0 R11: 0000000000000293 R12: 00007fbb780008c0\\nR13: 00007fbb78000938 R14: 0000000000608b30 R15: 00007fbb780029c8\\n \u003c/TASK\u003e\\n\\nAllocated by task 1050:\\n kasan_save_stack+0x1e/0x40\\n __kasan_kmalloc+0x81/0xa0\\n do_blk_trace_setup+0xcb/0x410\\n __blk_trace_setup+0xac/0x130\\n blk_trace_ioctl+0xe9/0x1c0\\n blkdev_ioctl+0xf1/0x390\\n __x64_sys_ioctl+0xa5/0xe0\\n do_syscall_64+0x35/0x80\\n entry_SYSCALL_64_after_hwframe+0x44/0xae\\n\\nFreed by task 1050:\\n kasan_save_stack+0x1e/0x40\\n kasan_set_track+0x21/0x30\\n kasan_set_free_info+0x20/0x30\\n __kasan_slab_free+0x103/0x180\\n kfree+0x9a/0x4c0\\n __blk_trace_remove+0x53/0x70\\n blk_trace_ioctl+0x199/0x1c0\\n blkdev_common_ioctl+0x5e9/0xb30\\n blkdev_ioctl+0x1a5/0x390\\n __x64_sys_ioctl+0xa5/0xe0\\n do_syscall_64+0x35/0x80\\n entry_SYSCALL_64_after_hwframe+0x44/0xae\\n\\nThe buggy address belongs to the object at ffff88816912f380\\n which belongs to the cache kmalloc-96 of size 96\\nThe buggy address is located 88 bytes inside of\\n 96-byte region [ffff88816912f380, ffff88816912f3e0)\\nThe buggy address belongs to the page:\\npage:000000009a1b4e7c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0f\\nflags: 0x17ffffc0000200(slab|node=0|zone=2|lastcpupid=0x1fffff)\\nraw: 0017ffffc0000200 ffffea00044f1100 dead000000000002 ffff88810004c780\\nraw: 0000000000000000 0000000000200020 00000001ffffffff 0000000000000000\\npage dumped because: kasan: bad access detected\\n\\nMemory state around the buggy address:\\n ffff88816912f280: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc\\n ffff88816912f300: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc\\n\u003effff88816912f380: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc\\n                                                    ^\\n ffff88816912f400: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc\\n ffff88816912f480: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc\\n==================================================================\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.27\", \"versionStartIncluding\": \"5.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.16.13\", \"versionStartIncluding\": \"5.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.17\", \"versionStartIncluding\": \"5.12\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:52:53.708Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-48913\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:52:53.708Z\", \"dateReserved\": \"2024-08-21T06:06:23.294Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-08-22T01:31:34.860Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.