{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2022-48719","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-06-20T11:09:39.051Z","datePublished":"2024-06-20T11:13:11.362Z","dateUpdated":"2025-05-04T08:21:41.202Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2025-05-04T08:21:41.202Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet, neigh: Do not trigger immediate probes on NUD_FAILED from neigh_managed_work\n\nsyzkaller was able to trigger a deadlock for NTF_MANAGED entries [0]:\n\n  kworker/0:16/14617 is trying to acquire lock:\n  ffffffff8d4dd370 (&tbl->lock){++-.}-{2:2}, at: ___neigh_create+0x9e1/0x2990 net/core/neighbour.c:652\n  [...]\n  but task is already holding lock:\n  ffffffff8d4dd370 (&tbl->lock){++-.}-{2:2}, at: neigh_managed_work+0x35/0x250 net/core/neighbour.c:1572\n\nThe neighbor entry turned to NUD_FAILED state, where __neigh_event_send()\ntriggered an immediate probe as per commit cd28ca0a3dd1 (\"neigh: reduce\narp latency\") via neigh_probe() given table lock was held.\n\nOne option to fix this situation is to defer the neigh_probe() back to\nthe neigh_timer_handler() similarly as pre cd28ca0a3dd1. For the case\nof NTF_MANAGED, this deferral is acceptable given this only happens on\nactual failure state and regular / expected state is NUD_VALID with the\nentry already present.\n\nThe fix adds a parameter to __neigh_event_send() in order to communicate\nwhether immediate probe is allowed or disallowed. Existing call-sites\nof neigh_event_send() default as-is to immediate probe. However, the\nneigh_managed_work() disables it via use of neigh_event_send_probe().\n\n[0] <TASK>\n  __dump_stack lib/dump_stack.c:88 [inline]\n  dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106\n  print_deadlock_bug kernel/locking/lockdep.c:2956 [inline]\n  check_deadlock kernel/locking/lockdep.c:2999 [inline]\n  validate_chain kernel/locking/lockdep.c:3788 [inline]\n  __lock_acquire.cold+0x149/0x3ab kernel/locking/lockdep.c:5027\n  lock_acquire kernel/locking/lockdep.c:5639 [inline]\n  lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5604\n  __raw_write_lock_bh include/linux/rwlock_api_smp.h:202 [inline]\n  _raw_write_lock_bh+0x2f/0x40 kernel/locking/spinlock.c:334\n  ___neigh_create+0x9e1/0x2990 net/core/neighbour.c:652\n  ip6_finish_output2+0x1070/0x14f0 net/ipv6/ip6_output.c:123\n  __ip6_finish_output net/ipv6/ip6_output.c:191 [inline]\n  __ip6_finish_output+0x61e/0xe90 net/ipv6/ip6_output.c:170\n  ip6_finish_output+0x32/0x200 net/ipv6/ip6_output.c:201\n  NF_HOOK_COND include/linux/netfilter.h:296 [inline]\n  ip6_output+0x1e4/0x530 net/ipv6/ip6_output.c:224\n  dst_output include/net/dst.h:451 [inline]\n  NF_HOOK include/linux/netfilter.h:307 [inline]\n  ndisc_send_skb+0xa99/0x17f0 net/ipv6/ndisc.c:508\n  ndisc_send_ns+0x3a9/0x840 net/ipv6/ndisc.c:650\n  ndisc_solicit+0x2cd/0x4f0 net/ipv6/ndisc.c:742\n  neigh_probe+0xc2/0x110 net/core/neighbour.c:1040\n  __neigh_event_send+0x37d/0x1570 net/core/neighbour.c:1201\n  neigh_event_send include/net/neighbour.h:470 [inline]\n  neigh_managed_work+0x162/0x250 net/core/neighbour.c:1574\n  process_one_work+0x9ac/0x1650 kernel/workqueue.c:2307\n  worker_thread+0x657/0x1110 kernel/workqueue.c:2454\n  kthread+0x2e9/0x3a0 kernel/kthread.c:377\n  ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295\n  </TASK>"}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["include/net/neighbour.h","net/core/neighbour.c"],"versions":[{"version":"7482e3841d520a368426ac196720601687e2dc47","lessThan":"203a35ebb49cdce377416b0690215d3ce090d364","status":"affected","versionType":"git"},{"version":"7482e3841d520a368426ac196720601687e2dc47","lessThan":"4a81f6da9cb2d1ef911131a6fd8bd15cb61fc772","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["include/net/neighbour.h","net/core/neighbour.c"],"versions":[{"version":"5.16","status":"affected"},{"version":"0","lessThan":"5.16","status":"unaffected","versionType":"semver"},{"version":"5.16.8","lessThanOrEqual":"5.16.*","status":"unaffected","versionType":"semver"},{"version":"5.17","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.16","versionEndExcluding":"5.16.8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.16","versionEndExcluding":"5.17"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/203a35ebb49cdce377416b0690215d3ce090d364"},{"url":"https://git.kernel.org/stable/c/4a81f6da9cb2d1ef911131a6fd8bd15cb61fc772"}],"title":"net, neigh: Do not trigger immediate probes on NUD_FAILED from neigh_managed_work","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-03T15:24:59.987Z"},"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/203a35ebb49cdce377416b0690215d3ce090d364","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/4a81f6da9cb2d1ef911131a6fd8bd15cb61fc772","tags":["x_transferred"]}]},{"metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2022-48719","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-09-10T17:11:19.414078Z"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-09-11T17:34:49.740Z"}}]}}