Vulnerability-Lookup

FKIE_CVE-2022-49647

Vulnerability from fkie_nvd - Published: 2025-02-26 07:01 - Updated: 2026-06-17 05:18

Severity

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: cgroup: Use separate src/dst nodes when preloading css_sets for migration Each cset (css_set) is pinned by its tasks. When we're moving tasks around across csets for a migration, we need to hold the source and destination csets to ensure that they don't go away while we're moving tasks about. This is done by linking cset->mg_preload_node on either the mgctx->preloaded_src_csets or mgctx->preloaded_dst_csets list. Using the same cset->mg_preload_node for both the src and dst lists was deemed okay as a cset can't be both the source and destination at the same time. Unfortunately, this overloading becomes problematic when multiple tasks are involved in a migration and some of them are identity noop migrations while others are actually moving across cgroups. For example, this can happen with the following sequence on cgroup1: #1> mkdir -p /sys/fs/cgroup/misc/a/b #2> echo $$ > /sys/fs/cgroup/misc/a/cgroup.procs #3> RUN_A_COMMAND_WHICH_CREATES_MULTIPLE_THREADS & #4> PID=$! #5> echo $PID > /sys/fs/cgroup/misc/a/b/tasks #6> echo $PID > /sys/fs/cgroup/misc/a/cgroup.procs the process including the group leader back into a. In this final migration, non-leader threads would be doing identity migration while the group leader is doing an actual one. After #3, let's say the whole process was in cset A, and that after #4, the leader moves to cset B. Then, during #6, the following happens: 1. cgroup_migrate_add_src() is called on B for the leader. 2. cgroup_migrate_add_src() is called on A for the other threads. 3. cgroup_migrate_prepare_dst() is called. It scans the src list. 4. It notices that B wants to migrate to A, so it tries to A to the dst list but realizes that its ->mg_preload_node is already busy. 5. and then it notices A wants to migrate to A as it's an identity migration, it culls it by list_del_init()'ing its ->mg_preload_node and putting references accordingly. 6. The rest of migration takes place with B on the src list but nothing on the dst list. This means that A isn't held while migration is in progress. If all tasks leave A before the migration finishes and the incoming task pins it, the cset will be destroyed leading to use-after-free. This is caused by overloading cset->mg_preload_node for both src and dst preload lists. We wanted to exclude the cset from the src list but ended up inadvertently excluding it from the dst list too. This patch fixes the issue by separating out cset->mg_preload_node into ->mg_src_preload_node and ->mg_dst_preload_node, so that the src and dst preloadings don't interfere with each other.

References

URL	Tags
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/05f7658210d1d331e8dd4cb6e7bbbe3df5f5ac27	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/07fd5b6cdf3cc30bfde8fe0f644771688be04447	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/0e41774b564befa6d271e8d5086bf870d617a4e6	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/54aee4e5ce8c21555286a6333e46c1713880cf93	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/7657e3958535d101a24ab4400f9b8062b9107cc4	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/ad44e05f3e016bdcb1ad25af35ade5b5f41ccd68	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/cec2bbdcc14fbaa6b95ee15a7c423b05d97038be	Patch

Impacted products

Vendor	Product	Version
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	5.19
linux	linux_kernel	5.19
linux	linux_kernel	5.19
linux	linux_kernel	5.19
linux	linux_kernel	5.19
linux	linux_kernel	5.19

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/cgroup-defs.h",
            "kernel/cgroup/cgroup.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "05f7658210d1d331e8dd4cb6e7bbbe3df5f5ac27",
              "status": "affected",
              "version": "f817de98513d060023be4fa1d061b29a6515273e",
              "versionType": "git"
            },
            {
              "lessThan": "cec2bbdcc14fbaa6b95ee15a7c423b05d97038be",
              "status": "affected",
              "version": "f817de98513d060023be4fa1d061b29a6515273e",
              "versionType": "git"
            },
            {
              "lessThan": "ad44e05f3e016bdcb1ad25af35ade5b5f41ccd68",
              "status": "affected",
              "version": "f817de98513d060023be4fa1d061b29a6515273e",
              "versionType": "git"
            },
            {
              "lessThan": "7657e3958535d101a24ab4400f9b8062b9107cc4",
              "status": "affected",
              "version": "f817de98513d060023be4fa1d061b29a6515273e",
              "versionType": "git"
            },
            {
              "lessThan": "54aee4e5ce8c21555286a6333e46c1713880cf93",
              "status": "affected",
              "version": "f817de98513d060023be4fa1d061b29a6515273e",
              "versionType": "git"
            },
            {
              "lessThan": "0e41774b564befa6d271e8d5086bf870d617a4e6",
              "status": "affected",
              "version": "f817de98513d060023be4fa1d061b29a6515273e",
              "versionType": "git"
            },
            {
              "lessThan": "07fd5b6cdf3cc30bfde8fe0f644771688be04447",
              "status": "affected",
              "version": "f817de98513d060023be4fa1d061b29a6515273e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/cgroup-defs.h",
            "kernel/cgroup/cgroup.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.16"
            },
            {
              "lessThan": "3.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.289",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.253",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.207",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.132",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.56",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C715C58E-FE6D-4E8A-B3B3-91BEE32F1721",
              "versionEndExcluding": "4.14.289",
              "versionStartIncluding": "3.16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "2B22ACD7-9025-4AD5-AD6E-A929DEC79B75",
              "versionEndExcluding": "4.19.253",
              "versionStartIncluding": "4.15",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C27A52F3-82C8-4F03-BE80-38D11CDBD503",
              "versionEndExcluding": "5.4.207",
              "versionStartIncluding": "4.20",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "46CE9FE9-22E3-45CA-8B5F-190C2CAFC5CE",
              "versionEndExcluding": "5.10.132",
              "versionStartIncluding": "5.5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "AF59CE2F-BA66-4BFD-83AB-4576F3D1B49A",
              "versionEndExcluding": "5.15.56",
              "versionStartIncluding": "5.11",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "640221A7-96EE-4B48-8FE1-BA810131789B",
              "versionEndExcluding": "5.18.13",
              "versionStartIncluding": "5.16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:5.19:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "A8C30C2D-F82D-4D37-AB48-D76ABFBD5377",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:5.19:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "BF8547FC-C849-4F1B-804B-A93AE2F04A92",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:5.19:rc3:*:*:*:*:*:*",
              "matchCriteriaId": "F3068028-F453-4A1C-B80F-3F5609ACEF60",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:5.19:rc4:*:*:*:*:*:*",
              "matchCriteriaId": "2E9C0DB0-D349-489F-A3D6-B77214E93A8A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:5.19:rc5:*:*:*:*:*:*",
              "matchCriteriaId": "1A0DE3B7-0FFB-45AA-9BD6-19870CA7C6FD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:5.19:rc6:*:*:*:*:*:*",
              "matchCriteriaId": "00AE778B-BAEE-49EB-9F84-003B73D7862A",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncgroup: Use separate src/dst nodes when preloading css_sets for migration\n\nEach cset (css_set) is pinned by its tasks. When we\u0027re moving tasks around\nacross csets for a migration, we need to hold the source and destination\ncsets to ensure that they don\u0027t go away while we\u0027re moving tasks about. This\nis done by linking cset-\u003emg_preload_node on either the\nmgctx-\u003epreloaded_src_csets or mgctx-\u003epreloaded_dst_csets list. Using the\nsame cset-\u003emg_preload_node for both the src and dst lists was deemed okay as\na cset can\u0027t be both the source and destination at the same time.\n\nUnfortunately, this overloading becomes problematic when multiple tasks are\ninvolved in a migration and some of them are identity noop migrations while\nothers are actually moving across cgroups. For example, this can happen with\nthe following sequence on cgroup1:\n\n #1\u003e mkdir -p /sys/fs/cgroup/misc/a/b\n #2\u003e echo $$ \u003e /sys/fs/cgroup/misc/a/cgroup.procs\n #3\u003e RUN_A_COMMAND_WHICH_CREATES_MULTIPLE_THREADS \u0026\n #4\u003e PID=$!\n #5\u003e echo $PID \u003e /sys/fs/cgroup/misc/a/b/tasks\n #6\u003e echo $PID \u003e /sys/fs/cgroup/misc/a/cgroup.procs\n\nthe process including the group leader back into a. In this final migration,\nnon-leader threads would be doing identity migration while the group leader\nis doing an actual one.\n\nAfter #3, let\u0027s say the whole process was in cset A, and that after #4, the\nleader moves to cset B. Then, during #6, the following happens:\n\n 1. cgroup_migrate_add_src() is called on B for the leader.\n\n 2. cgroup_migrate_add_src() is called on A for the other threads.\n\n 3. cgroup_migrate_prepare_dst() is called. It scans the src list.\n\n 4. It notices that B wants to migrate to A, so it tries to A to the dst\n    list but realizes that its -\u003emg_preload_node is already busy.\n\n 5. and then it notices A wants to migrate to A as it\u0027s an identity\n    migration, it culls it by list_del_init()\u0027ing its -\u003emg_preload_node and\n    putting references accordingly.\n\n 6. The rest of migration takes place with B on the src list but nothing on\n    the dst list.\n\nThis means that A isn\u0027t held while migration is in progress. If all tasks\nleave A before the migration finishes and the incoming task pins it, the\ncset will be destroyed leading to use-after-free.\n\nThis is caused by overloading cset-\u003emg_preload_node for both src and dst\npreload lists. We wanted to exclude the cset from the src list but ended up\ninadvertently excluding it from the dst list too.\n\nThis patch fixes the issue by separating out cset-\u003emg_preload_node into\n-\u003emg_src_preload_node and -\u003emg_dst_preload_node, so that the src and dst\npreloadings don\u0027t interfere with each other."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: cgroup: usar nodos src/dst separados al precargar css_sets para la migraci\u00f3n Cada cset (css_set) est\u00e1 fijado por sus tareas. Cuando estamos moviendo tareas entre csets para una migraci\u00f3n, necesitamos mantener los csets de origen y destino para asegurarnos de que no desaparezcan mientras movemos tareas. Esto se hace vinculando cset-\u0026gt;mg_preload_node en la lista mgctx-\u0026gt;preloaded_src_csets o mgctx-\u0026gt;preloaded_dst_csets. Se consider\u00f3 correcto usar el mismo cset-\u0026gt;mg_preload_node para las listas src y dst, ya que un cset no puede ser el origen y el destino al mismo tiempo. Desafortunadamente, esta sobrecarga se vuelve problem\u00e1tica cuando hay varias tareas involucradas en una migraci\u00f3n y algunas de ellas son migraciones de noop de identidad mientras que otras en realidad se est\u00e1n moviendo entre cgroup1: #1\u0026gt; mkdir -p /sys/fs/cgroup/misc/a/b #2\u0026gt; echo $$ \u0026gt; /sys/fs/cgroup/misc/a/cgroup.procs #3\u0026gt; RUN_A_COMMAND_WHICH_CREATES_MULTIPLE_THREADS \u0026amp; #4\u0026gt; PID=$! #5\u0026gt; echo $PID \u0026gt; /sys/fs/cgroup/misc/a/b/tasks #6\u0026gt; echo $PID \u0026gt; /sys/fs/cgroup/misc/a/cgroup.procs el proceso que incluye al l\u00edder del grupo de nuevo en a. En esta migraci\u00f3n final, los subprocesos que no son l\u00edderes estar\u00edan realizando la migraci\u00f3n de identidad mientras que el l\u00edder del grupo est\u00e1 realizando una real. Despu\u00e9s del n.\u00b0 3, digamos que todo el proceso estaba en cset A, y que despu\u00e9s del n.\u00b0 4, el l\u00edder se mueve al cset B. Luego, durante el n.\u00b0 6, sucede lo siguiente: 1. se llama a cgroup_migrate_add_src() en B para el l\u00edder. 2. se llama a cgroup_migrate_add_src() en A para los otros subprocesos. 3. se llama a cgroup_migrate_prepare_dst(). Escanea la lista src. 4. Se da cuenta de que B quiere migrar a A, por lo que intenta llevar A a la lista dst pero se da cuenta de que su -\u0026gt;mg_preload_node ya est\u00e1 ocupado. 5. y luego se da cuenta de que A quiere migrar a A como es una migraci\u00f3n de identidad, lo descarta haciendo list_del_init()\u0027ing su -\u0026gt;mg_preload_node y poniendo referencias en consecuencia. 6. El resto de la migraci\u00f3n se lleva a cabo con B en la lista src pero nada en la lista dst. Esto significa que A no se mantiene mientras la migraci\u00f3n est\u00e1 en progreso. Si todas las tareas abandonan A antes de que finalice la migraci\u00f3n y la tarea entrante lo fija, el cset se destruir\u00e1, lo que provocar\u00e1 un use-after-free. Esto se debe a la sobrecarga de cset-\u0026gt;mg_preload_node para las listas de precarga de src y dst. Quer\u00edamos excluir el cset de la lista de src, pero terminamos excluy\u00e9ndolo inadvertidamente tambi\u00e9n de la lista de dst. Este parche soluciona el problema al separar cset-\u0026gt;mg_preload_node en -\u0026gt;mg_src_preload_node y -\u0026gt;mg_dst_preload_node, de modo que las precargas de src y dst no interfieran entre s\u00ed."
    }
  ],
  "id": "CVE-2022-49647",
  "lastModified": "2026-06-17T05:18:44.497",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-49647",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-02-27T18:15:22.179725Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-02-26T07:01:39.863",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/05f7658210d1d331e8dd4cb6e7bbbe3df5f5ac27"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/07fd5b6cdf3cc30bfde8fe0f644771688be04447"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/0e41774b564befa6d271e8d5086bf870d617a4e6"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/54aee4e5ce8c21555286a6333e46c1713880cf93"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/7657e3958535d101a24ab4400f9b8062b9107cc4"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/ad44e05f3e016bdcb1ad25af35ade5b5f41ccd68"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/cec2bbdcc14fbaa6b95ee15a7c423b05d97038be"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

CVE-2022-49647 (GCVE-0-2022-49647)

Vulnerability from cvelistv5 – Published: 2025-02-26 02:23 – Updated: 2026-08-05 08:55

Title

cgroup: Use separate src/dst nodes when preloading css_sets for migration

Summary

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-02-27 18:15 UTC

CWE

CWE-416 - Use After Free

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6641 records in the last 180 days details

References

7 references

URL	Tags
https://git.kernel.org/stable/c/05f7658210d1d331e…
https://git.kernel.org/stable/c/cec2bbdcc14fbaa6b…
https://git.kernel.org/stable/c/ad44e05f3e016bdcb…
https://git.kernel.org/stable/c/7657e3958535d101a…
https://git.kernel.org/stable/c/54aee4e5ce8c21555…
https://git.kernel.org/stable/c/0e41774b564befa6d…
https://git.kernel.org/stable/c/07fd5b6cdf3cc30bf…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: f817de98513d060023be4fa1d061b29a6515273e , < 05f7658210d1d331e8dd4cb6e7bbbe3df5f5ac27 (git) Affected: f817de98513d060023be4fa1d061b29a6515273e , < cec2bbdcc14fbaa6b95ee15a7c423b05d97038be (git) Affected: f817de98513d060023be4fa1d061b29a6515273e , < ad44e05f3e016bdcb1ad25af35ade5b5f41ccd68 (git) Affected: f817de98513d060023be4fa1d061b29a6515273e , < 7657e3958535d101a24ab4400f9b8062b9107cc4 (git) Affected: f817de98513d060023be4fa1d061b29a6515273e , < 54aee4e5ce8c21555286a6333e46c1713880cf93 (git) Affected: f817de98513d060023be4fa1d061b29a6515273e , < 0e41774b564befa6d271e8d5086bf870d617a4e6 (git) Affected: f817de98513d060023be4fa1d061b29a6515273e , < 07fd5b6cdf3cc30bfde8fe0f644771688be04447 (git)
Linux	Linux	Affected: 3.16 Unaffected: 0 , < 3.16 (semver) Unaffected: 4.14.289 , ≤ 4.14.* (semver) Unaffected: 4.19.253 , ≤ 4.19.* (semver) Unaffected: 5.4.207 , ≤ 5.4.* (semver) Unaffected: 5.10.132 , ≤ 5.10.* (semver) Unaffected: 5.15.56 , ≤ 5.15.* (semver) Unaffected: 5.18.13 , ≤ 5.18.* (semver) Unaffected: 5.19 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-49647",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-27T18:15:22.179725Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-27T18:22:31.480Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/cgroup-defs.h",
            "kernel/cgroup/cgroup.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "05f7658210d1d331e8dd4cb6e7bbbe3df5f5ac27",
              "status": "affected",
              "version": "f817de98513d060023be4fa1d061b29a6515273e",
              "versionType": "git"
            },
            {
              "lessThan": "cec2bbdcc14fbaa6b95ee15a7c423b05d97038be",
              "status": "affected",
              "version": "f817de98513d060023be4fa1d061b29a6515273e",
              "versionType": "git"
            },
            {
              "lessThan": "ad44e05f3e016bdcb1ad25af35ade5b5f41ccd68",
              "status": "affected",
              "version": "f817de98513d060023be4fa1d061b29a6515273e",
              "versionType": "git"
            },
            {
              "lessThan": "7657e3958535d101a24ab4400f9b8062b9107cc4",
              "status": "affected",
              "version": "f817de98513d060023be4fa1d061b29a6515273e",
              "versionType": "git"
            },
            {
              "lessThan": "54aee4e5ce8c21555286a6333e46c1713880cf93",
              "status": "affected",
              "version": "f817de98513d060023be4fa1d061b29a6515273e",
              "versionType": "git"
            },
            {
              "lessThan": "0e41774b564befa6d271e8d5086bf870d617a4e6",
              "status": "affected",
              "version": "f817de98513d060023be4fa1d061b29a6515273e",
              "versionType": "git"
            },
            {
              "lessThan": "07fd5b6cdf3cc30bfde8fe0f644771688be04447",
              "status": "affected",
              "version": "f817de98513d060023be4fa1d061b29a6515273e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/cgroup-defs.h",
            "kernel/cgroup/cgroup.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.16"
            },
            {
              "lessThan": "3.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.289",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.253",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.207",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.132",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.56",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.289",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.253",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.207",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.132",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.56",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.13",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncgroup: Use separate src/dst nodes when preloading css_sets for migration\n\nEach cset (css_set) is pinned by its tasks. When we\u0027re moving tasks around\nacross csets for a migration, we need to hold the source and destination\ncsets to ensure that they don\u0027t go away while we\u0027re moving tasks about. This\nis done by linking cset-\u003emg_preload_node on either the\nmgctx-\u003epreloaded_src_csets or mgctx-\u003epreloaded_dst_csets list. Using the\nsame cset-\u003emg_preload_node for both the src and dst lists was deemed okay as\na cset can\u0027t be both the source and destination at the same time.\n\nUnfortunately, this overloading becomes problematic when multiple tasks are\ninvolved in a migration and some of them are identity noop migrations while\nothers are actually moving across cgroups. For example, this can happen with\nthe following sequence on cgroup1:\n\n #1\u003e mkdir -p /sys/fs/cgroup/misc/a/b\n #2\u003e echo $$ \u003e /sys/fs/cgroup/misc/a/cgroup.procs\n #3\u003e RUN_A_COMMAND_WHICH_CREATES_MULTIPLE_THREADS \u0026\n #4\u003e PID=$!\n #5\u003e echo $PID \u003e /sys/fs/cgroup/misc/a/b/tasks\n #6\u003e echo $PID \u003e /sys/fs/cgroup/misc/a/cgroup.procs\n\nthe process including the group leader back into a. In this final migration,\nnon-leader threads would be doing identity migration while the group leader\nis doing an actual one.\n\nAfter #3, let\u0027s say the whole process was in cset A, and that after #4, the\nleader moves to cset B. Then, during #6, the following happens:\n\n 1. cgroup_migrate_add_src() is called on B for the leader.\n\n 2. cgroup_migrate_add_src() is called on A for the other threads.\n\n 3. cgroup_migrate_prepare_dst() is called. It scans the src list.\n\n 4. It notices that B wants to migrate to A, so it tries to A to the dst\n    list but realizes that its -\u003emg_preload_node is already busy.\n\n 5. and then it notices A wants to migrate to A as it\u0027s an identity\n    migration, it culls it by list_del_init()\u0027ing its -\u003emg_preload_node and\n    putting references accordingly.\n\n 6. The rest of migration takes place with B on the src list but nothing on\n    the dst list.\n\nThis means that A isn\u0027t held while migration is in progress. If all tasks\nleave A before the migration finishes and the incoming task pins it, the\ncset will be destroyed leading to use-after-free.\n\nThis is caused by overloading cset-\u003emg_preload_node for both src and dst\npreload lists. We wanted to exclude the cset from the src list but ended up\ninadvertently excluding it from the dst list too.\n\nThis patch fixes the issue by separating out cset-\u003emg_preload_node into\n-\u003emg_src_preload_node and -\u003emg_dst_preload_node, so that the src and dst\npreloadings don\u0027t interfere with each other."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is triggered by writing to cgroupfs control files (cgroup.procs/tasks/cgroup.threads) via local syscalls on the mounted cgroup filesystem, not by network packet processing or adjacent-network protocols.\nAC:L - An attacker fully controls the migration sequence (multi-threaded process, per-thread move via tasks/cgroup.threads, then whole-process move via cgroup.procs) and can arrange concurrent task teardown that drops the last css_set refs, so success does not depend on victim-side conditions outside attacker influence.\nPR:L - Write access to a delegated cgroup subtree is sufficient: mkdir sets file ownership to the creator (cgroup_kn_set_ugid), cgroup.procs/threads are NS_DELEGATABLE, and cgroup1 only requires euid match to move one\u0027s own tasks\u2014common for containers and systemd Delegate= setups without real init-ns root.\nUI:N - The attacker performs the cgroup writes and process/thread setup directly; no separate victim user action is required.\nS:U - This is a host-kernel css_set use-after-free enabling privilege escalation within the same kernel authority, not a VM/IOMMU/sandbox boundary escape.\nC:H - The bug is a use-after-free of a css_set used as the migration destination; UAF of a kernel object enables reclaim/spray and arbitrary read primitives.\nI:H - The same css_set UAF is exploitable for heap manipulation and control-flow hijacking / arbitrary write, enabling integrity compromise and code execution in kernel context.\nA:H - Dereferencing the unpinned/freed destination css_set during cgroup_migrate_execute can oops/panic the kernel even when not fully exploited for code execution."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:55:55.097Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/05f7658210d1d331e8dd4cb6e7bbbe3df5f5ac27"
        },
        {
          "url": "https://git.kernel.org/stable/c/cec2bbdcc14fbaa6b95ee15a7c423b05d97038be"
        },
        {
          "url": "https://git.kernel.org/stable/c/ad44e05f3e016bdcb1ad25af35ade5b5f41ccd68"
        },
        {
          "url": "https://git.kernel.org/stable/c/7657e3958535d101a24ab4400f9b8062b9107cc4"
        },
        {
          "url": "https://git.kernel.org/stable/c/54aee4e5ce8c21555286a6333e46c1713880cf93"
        },
        {
          "url": "https://git.kernel.org/stable/c/0e41774b564befa6d271e8d5086bf870d617a4e6"
        },
        {
          "url": "https://git.kernel.org/stable/c/07fd5b6cdf3cc30bfde8fe0f644771688be04447"
        }
      ],
      "title": "cgroup: Use separate src/dst nodes when preloading css_sets for migration",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49647",
    "datePublished": "2025-02-26T02:23:51.561Z",
    "dateReserved": "2025-02-26T02:21:30.432Z",
    "dateUpdated": "2026-08-05T08:55:55.097Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted