Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - udmabuf如果建立 sg 表格失敗則設定 ubuf->sg = NULL。當使用者空間嘗試對應 dmabuf 且如果因為某些原因 (例如 OOM) 建立 sg 表格失敗時ubuf->sg 必須設定為NULL。
    否則當使用者空間隨後關閉 dmabuf fd我們會嘗試從 release_udmabuf 錯誤釋放無效的 sg 表格進而導致 syzbot 報告一般保護錯誤一般保護錯誤 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN KASANnull-ptr-deref 在範圍 [0x0000000000000000-0x0000000000000007] CPU0 PID3609 通訊syz-executor487 未污染 5.19.0-syzkaller-13930-g7ebfc85e2cd7 #0 硬體名稱Google Google/Google 計算引擎Compute Engine、BIOS Google 07/22/2022 RIP0010:dma_unmap_sgtable include/linux/dma-mapping.h:378 [內嵌] RIP
    0010:put_sg_table drivers/dma-buf/udmabuf.c:89 [內嵌] RIP0010:release_udmabuf+0xcb/0x4f0 drivers/dma-buf/udmabuf.c:114 程式碼48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 2b 04 00 00 48 8d 7d 0c 4c 8b 63 30 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 4d0 7c 8 d2 0f 85 e2 RSP0018:ffffc900037efd30 EFLAGS00010246 RAXdffffc0000000000 RBXffffffff8cb67800 RCX
    0000000000000000 RDX: 0000000000000000 RSI: ffffffff84ad27e0 RDI: 0000000000000000 RBP: fffffffffffffff4 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000000 R11: 000000000008c07c R12:
    ffff88801fa05000 R13ffff888073db07e8 R14ffff888025c25440 R150000000000000000 FS
    0000555555fc4300(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0
    0000000080050033 CR2: 00007fc1c0ce06e4 CR3: 00000000715e6000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
    0000000000000400 呼叫追踪 <TASK> dma_buf_release+0x157/0x2d0 drivers/dma-buf/dma-buf.c:78
    __dentry_kill+0x42b/0x640 fs/dcache.c:612 dentry_kill fs/dcache.c:733 [內嵌] dput+0x806/0xdb0 fs/dcache.c:913 __fput+0x39c/0x9d0 fs/file_table.c:333 task_work_run+0xdd /0x1a0 kernel/task_work.c:177 ptrace_notify+0x114/0x140 kernel/signal.c:2353 ptrace_report_syscall include/linux/ptrace.h:420 [內嵌] ptrace_report_syscall_exit include/linux/ptrace.h:482 [內嵌] syscall_exit_work kernel/ entry/common.c:249 [內嵌] syscall_exit_to_user_mode_prepare+0x129/0x280 kernel/entry/common.c:276
    __syscall_exit_to_user_mode_work kernel/entry/common.c:281 [內嵌] syscall_exit_to_user_mode+0x9/0x50 kernel/entry/common.c:294 do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP 0033:0x7fc1c0c35b6b 程式碼0f 05 48 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8 63 fc ff ff 8b 7c 24 0c 41 89 c0 0 b8 03 050 0 [ 30 00 03 050 ] <48> f [ ] 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 a1 fc ff ff 8b 44 RSP: 002b:00007ffd78a06090 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 RAX: 0000000000000000 RBX: 0000000000000007 RCX: 00007fc1c0c35b6b RDX:
    0000000020000280 RSI: 0000000040086200 RDI: 0000000000000006 RBP: 0000000000000007 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000293 R12: 000000000000000c R13:
    0000000000000003 R1400007fc1c0cfe4a0 R1500007ffd78a06140 </TASK> 連結的模組 ---[ end trace 0000000000000000 ]--- RIP 0010:dma_unmap_sgtable include/linux/dma-mapping.h:378 [內嵌] :RIP
    0010:put_sg_table drivers/dma-buf/udmabuf.c:89 [內嵌] RIP0010:release_udmabuf+0xcb/0x4f0 drivers/dma-buf/udmabuf.c:114 (CVE-2022-50819)

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

偵測

Linux Distros 未修補的弱點：CVE-2022-50819

high Nessus Plugin ID 280795

版本 1.2