[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"cve-CVE-2022-50563":3},{"id":4,"cve_id":5,"euvd_id":6,"summary":7,"published":8,"cvss_data":9,"is_remote":10,"cwes":11,"cpes":12,"technologies":13,"references":14,"score":24,"epss_score":25,"epss_percentile":26,"is_kev":10,"cisa_kev_date_added":27,"cisa_kev_due_date":27,"cisa_ssvc":28,"attack_mappings":34,"exploits":35},301180,"CVE-2022-50563","EUVD-2022-55665","In the Linux kernel, the following vulnerability has been resolved:\n\ndm thin: Fix UAF in run_timer_softirq()\n\nWhen dm_resume() and dm_destroy() are concurrent, it will\nlead to UAF, as follows:\n\n BUG: KASAN: use-after-free in __run_timers+0x173\u002F0x710\n Write of size 8 at addr ffff88816d9490f0 by task swapper\u002F0\u002F0\n\u003Csnip>\n Call Trace:\n  \u003CIRQ>\n  dump_stack_lvl+0x73\u002F0x9f\n  print_report.cold+0x132\u002F0xaa2\n  _raw_spin_lock_irqsave+0xcd\u002F0x160\n  __run_timers+0x173\u002F0x710\n  kasan_report+0xad\u002F0x110\n  __run_timers+0x173\u002F0x710\n  __asan_store8+0x9c\u002F0x140\n  __run_timers+0x173\u002F0x710\n  call_timer_fn+0x310\u002F0x310\n  pvclock_clocksource_read+0xfa\u002F0x250\n  kvm_clock_read+0x2c\u002F0x70\n  kvm_clock_get_cycles+0xd\u002F0x20\n  ktime_get+0x5c\u002F0x110\n  lapic_next_event+0x38\u002F0x50\n  clockevents_program_event+0xf1\u002F0x1e0\n  run_timer_softirq+0x49\u002F0x90\n  __do_softirq+0x16e\u002F0x62c\n  __irq_exit_rcu+0x1fa\u002F0x270\n  irq_exit_rcu+0x12\u002F0x20\n  sysvec_apic_timer_interrupt+0x8e\u002F0xc0\n\nOne of the concurrency UAF can be shown as below:\n\n        use                                  free\ndo_resume                           |\n  __find_device_hash_cell           |\n    dm_get                          |\n      atomic_inc(&md->holders)      |\n                                    | dm_destroy\n                                    |   __dm_destroy\n                                    |     if (!dm_suspended_md(md))\n                                    |     atomic_read(&md->holders)\n                                    |     msleep(1)\n  dm_resume                         |\n    __dm_resume                     |\n      dm_table_resume_targets       |\n        pool_resume                 |\n          do_waker  #add delay work |\n  dm_put                            |\n    atomic_dec(&md->holders)        |\n                                    |     dm_table_destroy\n                                    |       pool_dtr\n                                    |         __pool_dec\n                                    |           __pool_destroy\n                                    |             destroy_workqueue\n                                    |             kfree(pool) # free pool\n        time out\n__do_softirq\n  run_timer_softirq # pool has already been freed\n\nThis can be easily reproduced using:\n  1. create thin-pool\n  2. dmsetup suspend pool\n  3. dmsetup resume pool\n  4. dmsetup remove_all # Concurrent with 3\n\nThe root cause of this UAF bug is that dm_resume() adds timer after\ndm_destroy() skips cancelling the timer because of suspend status.\nAfter timeout, it will call run_timer_softirq(), however pool has\nalready been freed. The concurrency UAF bug will happen.\n\nTherefore, cancelling timer again in __pool_destroy().","2025-10-22T14:15:00Z",{},false,[],[],[],[15,16,17,18,19,20,21,22,23],"https:\u002F\u002Fgit.kernel.org\u002Fstable\u002Fc\u002F34cd15d83b7206188d440b29b68084fcafde9395","https:\u002F\u002Fgit.kernel.org\u002Fstable\u002Fc\u002F34fe9c2251f19786a6689149a6212c6c0de1d63b","https:\u002F\u002Fgit.kernel.org\u002Fstable\u002Fc\u002F550a4fac7ecfee5bac6a0dd772456ca62fb72f46","https:\u002F\u002Fgit.kernel.org\u002Fstable\u002Fc\u002F7ae6aa649394e1e7f6dafb55ce0d578c0572a280","https:\u002F\u002Fgit.kernel.org\u002Fstable\u002Fc\u002F7ee059d06a5d3c15465959e0472993e80fbe4e81","https:\u002F\u002Fgit.kernel.org\u002Fstable\u002Fc\u002F88430ebcbc0ec637b710b947738839848c20feff","https:\u002F\u002Fgit.kernel.org\u002Fstable\u002Fc\u002F94e231c9d6f2648d2f1f68e7f476e050ee0a6159","https:\u002F\u002Fgit.kernel.org\u002Fstable\u002Fc\u002Fd9971fa4d8bde63d49c743c1b32d12fbbd3a30bd","https:\u002F\u002Fgit.kernel.org\u002Fstable\u002Fc\u002Fe8b8e0d2bbf7d1172c4f435621418e29ee408d46",0,0.00249,0.1601,null,{"timestamp":27,"automatable":29,"tech_impact":30,"exploitation":31,"cisa_decision":32,"cisa_remediation_timeline":33},"no","partial","none",{},"FSU",[],[]]