arm64: fix oops in concurrently setting insn_emulation sysctls (Linux Linux)

CVE-2022-50206
MEDIUM 5.5

At a glance

Source
NVD
EPSS
EPSS 0.25 % · percentile 16 ()
State
PUBLISHED
Published
Updated
Assigner
Linux
NVD status
Analyzed

Description

In the Linux kernel, the following vulnerability has been resolved: arm64: fix oops in concurrently setting insn_emulation sysctls emulation_proc_handler() changes table->data for proc_dointvec_minmax and can generate the following Oops if called concurrently with itself: | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010 | Internal error: Oops: 96000006 [#1] SMP | Call trace: | update_insn_emulation_mode+0xc0/0x148 | emulation_proc_handler+0x64/0xb8 | proc_sys_call_handler+0x9c/0xf8 | proc_sys_write+0x18/0x20 | __vfs_write+0x20/0x48 | vfs_write+0xe4/0x1d0 | ksys_write+0x70/0xf8 | __arm64_sys_write+0x20/0x28 | el0_svc_common.constprop.0+0x7c/0x1c0 | el0_svc_handler+0x2c/0xa0 | el0_svc+0x8/0x200 To fix this issue, keep the table->data as &insn->current_mode and use container_of() to retrieve the insn pointer. Another mutex is used to protect against the current_mode update but not for retrieving insn_emulation as table->data is no longer changing.

Weaknesses (CWE)

  • CWE-476 — NULL Pointer Dereference

References

Scores

VersionScoreVectorScored by
CVSS 3.1MEDIUM 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD · nvd@nist.gov (Primary)

European references

CERT-FR advisories

Affected configurations (NVD CPE)

Affected products

ProductVersions
Linux · Linuxaffected 587064b610c703f259317d00dc37bf6d40f4fc74 < 9d5fec6ba2e4117d196a8259ab54615ffe562460 ; affected 587064b610c703f259317d00dc37bf6d40f4fc74 < b51881b1da57fe9877125dfdd0aac5172958fcfd ; affected 587064b610c703f259317d00dc37bf6d40f4fc74 < 04549063d5701976034d8c2bfda3d3a8cbf0409f ; affected 587064b610c703f259317d00dc37bf6d40f4fc74 < 353b4673d01c512303c45cf2346f630cda73b5c9 ; affected 587064b610c703f259317d00dc37bf6d40f4fc74 < cc69ef95988b9ef2fc730ec452a7441efb90ef5e ; affected 587064b610c703f259317d00dc37bf6d40f4fc74 < 6a2fd114678d7fc1b5a0f8865ae98f1c17787455
Linux · Linuxaffected 3.19 ; unaffected 0 < 3.19 ; unaffected 4.14.291 ≤ 4.14.* ; unaffected 4.19.256 ≤ 4.19.* ; unaffected 5.4.211 ≤ 5.4.* ; unaffected 5.10.137 ≤ 5.10.*

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD