medium 5.5

CVE-2022-48644 json

net/sched: taprio: avoid disabling offload when it was never enabled

published 2024-04-28 2 y ago modified 2026-06-17 4 mo ago also EUVD-2022-51339

cvss: 5.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 14%
public exploits: 0; none known

In the Linux kernel, the following vulnerability has been resolved:

In an incredibly strange API design decision, qdisc->destroy() gets called even if qdisc->init() never succeeded, not exclusively since commit 87b60cfacf9f ("net_sched: fix error recovery at qdisc creation"), but apparently also earlier (in the case of qdisc_create_dflt()).

The taprio qdisc does not fully acknowledge this when it attempts full offload, because it starts off with q->flags = TAPRIO_FLAGS_INVALID in taprio_init(), then it replaces q->flags with TCA_TAPRIO_ATTR_FLAGS parsed from netlink (in taprio_change(), tail called from taprio_init()).

But in taprio_destroy(), we call taprio_disable_offload(), and this determines what to do based on FULL_OFFLOAD_IS_ENABLED(q->flags).

But looking at the implementation of FULL_OFFLOAD_IS_ENABLED() (a bitwise check of bit 1 in q->flags), it is invalid to call this macro on q->flags when it contains TAPRIO_FLAGS_INVALID, because that is set to U32_MAX, and therefore FULL_OFFLOAD_IS_ENABLED() will return true on an invalid set of flags.

As a result, it is possible to crash the kernel if user space forces an error between setting q->flags = TAPRIO_FLAGS_INVALID, and the calling of taprio_enable_offload(). This is because drivers do not expect the offload to be disabled when it was never enabled.

The error that we force here is to attach taprio as a non-root qdisc, but instead as child of an mqprio root qdisc:

$ tc qdisc add dev swp0 root handle 1: \ mqprio num_tc 8 map 0 1 2 3 4 5 6 7 \ queues 1@0 1@1 1@2 1@3 1@4 1@5 1@6 1@7 hw 0 $ tc qdisc replace dev swp0 parent 1:1 \ taprio num_tc 8 map 0 1 2 3 4 5 6 7 \ queues 1@0 1@1 1@2 1@3 1@4 1@5 1@6 1@7 base-time 0 \ sched-entry S 0x7f 990000 sched-entry S 0x80 100000 \ flags 0x0 clockid CLOCK_TAI Unable to handle kernel paging request at virtual address fffffffffffffff8 [fffffffffffffff8] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 96000004 [#1] PREEMPT SMP Call trace: taprio_dump+0x27c/0x310 vsc9959_port_setup_tc+0x1f4/0x460 felix_port_setup_tc+0x24/0x3c dsa_slave_setup_tc+0x54/0x27c taprio_disable_offload.isra.0+0x58/0xe0 taprio_destroy+0x80/0x104 qdisc_create+0x240/0x470 tc_modify_qdisc+0x1fc/0x6b0 rtnetlink_rcv_msg+0x12c/0x390 netlink_rcv_skb+0x5c/0x130 rtnetlink_rcv+0x1c/0x2c

Fix this by keeping track of the operations we made, and undo the offload only if we actually did it.

I've added "bool offloaded" inside a 4 byte hole between "int clockid" and "atomic64_t picos_per_byte". Now the first cache line looks like below:

$ pahole -C taprio_sched net/sched/sch_taprio.o struct taprio_sched { struct Qdisc * * qdiscs; /* 0 8 */ struct Qdisc * root; /* 8 8 */ u32 flags; /* 16 4 */ enum tk_offsets tk_offset; /* 20 4 */ int clockid; /* 24 4 */ bool offloaded; /* 28 1 */

/* XXX 3 bytes hole, try to pack */

atomic64_t picos_per_byte; /* 32 0 */

/* XXX 8 bytes hole, try to pack */

spinlock_t current_entry_lock; /* 40 0 */

/* XXX 8 bytes hole, try to pack */

struct sched_entry * current_entry; /* 48 8 */ struct sched_gate_list * oper_sched; /* 56 8 */ /* --- cacheline 1 boundary (64 bytes) --- */

Patch / fix

fixed in 1 distros 3 links 5

Linux Linux 5.4.215, 5.10.146, 5.15.71, 5.19.12, 6.0

debian ubuntu suse

linux Debian 14, Debian 13, Debian 12 6.0.2-1

debian advisories DEBIAN-CVE-2022-48644

linux Ubuntu 20.04 LTS 5.4.0-136.153
linux Ubuntu 22.04 LTS 5.15.0-57.63
linux-aws Ubuntu 20.04 LTS 5.4.0-1093.101
linux-aws Ubuntu 22.04 LTS 5.15.0-1027.31
linux-gcp Ubuntu 20.04 LTS 5.4.0-1097.106
linux-gcp Ubuntu 22.04 LTS 5.15.0-1026.33
linux-gke Ubuntu 22.04 LTS 5.15.0-1024.29
linux-ibm Ubuntu 20.04 LTS 5.4.0-1041.46

ubuntu advisories UBUNTU-CVE-2022-48644

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

kernel-rt SLE Micro 5.5, Real Time Module 15 SP5, openSUSE Leap 15.5 5.14.21-150500.13.52.1
kernel-syms-rt Real Time Module 15 SP5, openSUSE Leap 15.5 5.14.21-150500.13.52.1
kernel-rt_debug Real Time Module 15 SP5, openSUSE Leap 15.5 5.14.21-150500.13.52.1
kernel-source-rt SLE Micro 5.5, Real Time Module 15 SP5, openSUSE Leap 15.5 5.14.21-150500.13.52.1
dtb-aarch64 openSUSE Leap 15.5 5.14.21-150500.55.62.1
kernel-64kb SLE Module for Basesystem 15 SP5, openSUSE Leap 15.5 5.14.21-150500.55.62.2
kernel-syms SLE Module for Development Tools 15 SP5, openSUSE Leap 15.5 5.14.21-150500.55.62.1
kernel-obs-qa openSUSE Leap 15.5 5.14.21-150500.55.62.1

suse advisories SUSE-SU-2024:1663-1 SUSE-SU-2024:1659-1 SUSE-SU-2024:1644-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-48644 updated 2026-11-08 cvss 6.1

kernel: net/sched: taprio: avoid disabling offload when it was never enabled

Red Hat Enterprise Linux 9 kernel-rt, kernel-rt-selftests-internal
affected: no fix available
Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +82 more
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 2 y ago (2024-09-10)

Exploit prediction

0.23% chance of exploitation in the next 30 days, higher than 14% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Linux Linux

Classification

Weakness

CWE-476 NULL Pointer Dereference

Technology feeds

Linux kernel rss critical rss

References

Sources

CVE List CVE-2022-48644
NVD CVE-2022-48644

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary