CVE-2022-48692

What it actually does

NULL pointer dereference in the Linux kernel RDMA SRP receive completion handler (srp_recv_done) when the SCSI command pointer is unexpectedly NULL, resulting in a kernel oops and potential crash during softirq processing of IB completions.

Why it matters to the business

Systems using Linux kernel RDMA SRP storage targets may experience unexpected crashes or reboots under specific I/O workloads, leading to service disruption and potential data access loss until the system is recovered.

How an attack unfolds

An attacker with local access or the ability to trigger I/O patterns against an SRP target (such as through crafted blktests or equivalent workload) causes the receive done path to be invoked with a NULL command structure; the handler then dereferences the NULL pointer when setting result fields, triggering the kernel fault.

How to fix it

Update the Linux kernel to the commit f022576aa03c2385ea7f2b27ee5b331e43abf624 or later stable releases that include the fix ensuring scmnd is checked before use.

How to confirm the fix worked

Confirm the running kernel contains commit f022576aa03c2385ea7f2b27ee5b331e43abf624; attempt to reproduce the srp/007 blktest workload and verify absence of the NULL pointer oops in dmesg or kernel logs.

Typical attack path

1. Obtain local access or ability to submit I/O to an RDMA SRP target
2. Trigger specific completion events that leave the SCSI command pointer NULL
3. Invoke srp_recv_done via IB completion polling in softirq context
4. Execute the dereference of the NULL pointer at offset 0x170
5. Cause kernel panic or oops leading to denial of service

How to detect it

Inspect kernel logs and dmesg for oops traces containing srp_recv_done, kblockd workqueue, and NULL pointer dereference at address 0000000000000170; correlate with IB completion polling and IRQ exit paths.

What your security team should do

• Prioritize kernel upgrades to the fixed commit on all systems using RDMA SRP
• Monitor for kernel oops reports involving srp_recv_done
• Restrict local access and limit untrusted I/O workloads against SRP targets until patched
• Test the fix in staging environments with blktests or equivalent storage workloads