« Volver al listado

CVE-2022-50117

Estado: AnalizadaMedia (5.5)—

In the Linux kernel, the following vulnerability has been resolved:

vfio: Split migration ops from main device ops

vfio core checks whether the driver sets some migration op (e.g. set_state/get_state) and accordingly calls its op.

However, currently mlx5 driver sets the above ops without regards to its migration caps.

This might lead to unexpected usage/Oops if user space may call to the above ops even if the driver doesn't support migration. As for example, the migration state_mutex is not initialized in that case.

The cleanest way to manage that seems to split the migration ops from the main device ops, this will let the driver setting them separately from the main ops when it's applicable.

Leer descripción completaMostrar menos

As part of that, validate ops construction on registration and include a check for VFIO_MIGRATION_STOP_COPY since the uAPI claims it must be set in migration_flags.

HISI driver was changed as well to match this scheme.

This scheme may enable down the road to come with some extra group of ops (e.g. DMA log) that can be set without regards to the other options based on driver caps.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Linux — Linux Kernel

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-50117",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6fadb021266d03c5fd7bca2cfa1607efd246dad1",
              "lessThan": "bba6b12d73d36e0ddbc2c3ac5668a667b00d4345",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6fadb021266d03c5fd7bca2cfa1607efd246dad1",
              "lessThan": "6e97eba8ad8748fabb795cffc5d9e1a7dcfd7367",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c",
            "drivers/vfio/pci/mlx5/cmd.c",
            "drivers/vfio/pci/mlx5/cmd.h",
            "drivers/vfio/pci/mlx5/main.c",
            "drivers/vfio/pci/vfio_pci_core.c",
            "drivers/vfio/vfio.c",
            "include/linux/vfio.h"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.18",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.19.2",
              "versionType": "semver",
              "lessThanOrEqual": "5.19.*"
            },
            {
              "status": "unaffected",
              "version": "6.0",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c",
            "drivers/vfio/pci/mlx5/cmd.c",
            "drivers/vfio/pci/mlx5/cmd.h",
            "drivers/vfio/pci/mlx5/main.c",
            "drivers/vfio/pci/vfio_pci_core.c",
            "drivers/vfio/vfio.c",
            "include/linux/vfio.h"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-06-18T11:15:41.370",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/6e97eba8ad8748fabb795cffc5d9e1a7dcfd7367",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/bba6b12d73d36e0ddbc2c3ac5668a667b00d4345",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvfio: Split migration ops from main device ops\n\nvfio core checks whether the driver sets some migration op (e.g.\nset_state/get_state) and accordingly calls its op.\n\nHowever, currently mlx5 driver sets the above ops without regards to its\nmigration caps.\n\nThis might lead to unexpected usage/Oops if user space may call to the\nabove ops even if the driver doesn't support migration. As for example,\nthe migration state_mutex is not initialized in that case.\n\nThe cleanest way to manage that seems to split the migration ops from\nthe main device ops, this will let the driver setting them separately\nfrom the main ops when it's applicable.\n\nAs part of that, validate ops construction on registration and include a\ncheck for VFIO_MIGRATION_STOP_COPY since the uAPI claims it must be set\nin migration_flags.\n\nHISI driver was changed as well to match this scheme.\n\nThis scheme may enable down the road to come with some extra group of\nops (e.g. DMA log) that can be set without regards to the other options\nbased on driver caps."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: vfio: Dividir operaciones de migración de las operaciones del dispositivo principal El núcleo vfio verifica si el controlador establece alguna operación de migración (por ejemplo, set_state/get_state) y, en consecuencia, llama a su operación. Sin embargo, actualmente el controlador mlx5 establece las operaciones anteriores sin tener en cuenta sus límites de migración. Esto puede llevar a un uso inesperado/Oops si el espacio de usuario puede llamar a las operaciones anteriores incluso si el controlador no admite la migración. Como por ejemplo, el state_mutex de migración no se inicializa en ese caso. La forma más limpia de gestionar eso parece dividir las operaciones de migración de las operaciones del dispositivo principal, esto permitirá que el controlador las configure por separado de las operaciones principales cuando sea aplicable. Como parte de eso, valide la construcción de las operaciones en el registro e incluya una comprobación para VFIO_MIGRATION_STOP_COPY ya que la uAPI afirma que debe establecerse en migration_flags. El controlador HISI también se cambió para que coincida con este esquema. Este esquema puede permitir en el futuro contar con algún grupo adicional de operaciones (por ejemplo, registro DMA) que se pueden configurar sin tener en cuenta las otras opciones en función de las capacidades del controlador."
    }
  ],
  "lastModified": "2026-06-17T05:22:47.697",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9DDA808D-1762-4306-BFCC-F1E9219F4F14",
              "versionEndExcluding": "5.19.2",
              "versionStartIncluding": "5.18"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}