Message-ID: <2025061845-CVE-2022-50215-d5fc@gregkh>
Date: Wed, 18 Jun 2025 13:04:40 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2022-50215: scsi: sg: Allow waiting for commands to complete on removed device

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

scsi: sg: Allow waiting for commands to complete on removed device

When a SCSI device is removed while in active use, currently sg will
immediately return -ENODEV on any attempt to wait for active commands that
were sent before the removal.  This is problematic for commands that use
SG_FLAG_DIRECT_IO since the data buffer may still be in use by the kernel
when userspace frees or reuses it after getting ENODEV, leading to
corrupted userspace memory (in the case of READ-type commands) or corrupted
data being sent to the device (in the case of WRITE-type commands).  This
has been seen in practice when logging out of a iscsi_tcp session, where
the iSCSI driver may still be processing commands after the device has been
marked for removal.

Change the policy to allow userspace to wait for active sg commands even
when the device is being removed.  Return -ENODEV only when there are no
more responses to read.

The Linux kernel CVE team has assigned CVE-2022-50215 to this issue.


Affected and fixed versions
===========================

	Fixed in 4.9.326 with commit bbc118acf7baf9e93c5e1314d14f481301af4d0f
	Fixed in 4.14.291 with commit f5e61d9b4a699dd16f32d5f39eb1cf98d84c92ed
	Fixed in 4.19.256 with commit ed9afd967cbfe7da2dc0d5e52c62a778dfe9f16b
	Fixed in 5.4.211 with commit f135c65085eed869d10e4e7923ce1015288618da
	Fixed in 5.10.137 with commit 408bfa1489a3cfe7150b81ab0b0df99b23dd5411
	Fixed in 5.15.61 with commit 8c004b7dbb340c1e5889f5fb9e5baa6f6e5303e8
	Fixed in 5.18.18 with commit 35e60ec39e862159cb92923eefd5230d4a873cb9
	Fixed in 5.19.2 with commit 03d8241112d5e3cccce1a01274a221099f07d2e1
	Fixed in 6.0 with commit 3455607fd7be10b449f5135c00dc306b85dc0d21

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-50215
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/scsi/sg.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/bbc118acf7baf9e93c5e1314d14f481301af4d0f
	https://git.kernel.org/stable/c/f5e61d9b4a699dd16f32d5f39eb1cf98d84c92ed
	https://git.kernel.org/stable/c/ed9afd967cbfe7da2dc0d5e52c62a778dfe9f16b
	https://git.kernel.org/stable/c/f135c65085eed869d10e4e7923ce1015288618da
	https://git.kernel.org/stable/c/408bfa1489a3cfe7150b81ab0b0df99b23dd5411
	https://git.kernel.org/stable/c/8c004b7dbb340c1e5889f5fb9e5baa6f6e5303e8
	https://git.kernel.org/stable/c/35e60ec39e862159cb92923eefd5230d4a873cb9
	https://git.kernel.org/stable/c/03d8241112d5e3cccce1a01274a221099f07d2e1
	https://git.kernel.org/stable/c/3455607fd7be10b449f5135c00dc306b85dc0d21

Powered by blists - more mailing lists