CVE-2022-48890 scsi: storvsc: Fix swiotlb bounce buffer leak in confidential VM
A memory leak in the Linux kernel's storvsc driver can exhaust bounce buffers, causing I/O denial of service in confidential VMs.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-48890?
CVE-2022-48890 is a medium-severity denial of service vulnerability in Linux kernel, published on 21 Aug 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
scsi: storvsc: Fix swiotlb bounce buffer leak in confidential VM
storvsc_queuecommand() maps the scatter/gather list using scsi_dma_map(), which in a confidential VM allocates swiotlb bounce buffers. If the I/O submission fails in storvsc_do_io(), the I/O is typically retried by higher level code, but the bounce buffer memory is never freed. The mostly like cause of I/O submission failure is a full VMBus channel ring buffer, which is not uncommon under high I/O loads. Eventually enough bounce buffer memory leaks that the confidential VM can't do any I/O. The same problem can arise in a non-confidential VM with kernel boot parameter swiotlb=force.
Fix this by doing scsi_dma_unmap() in the case of an I/O submission error, which frees the bounce buffer memory.
Weakness: CWE-401
Which versions are affected by CVE-2022-48890?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2022-48890?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-48890 being exploited?
There is no known exploitation of CVE-2022-48890 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2022-48890, GHSA-7fhg-f25c-34r6, UBUNTU-CVE-2022-48890.