CVE-2022-3623: Linux Kernel BPF gup.c follow_page_pte race condition
A vulnerability was found in followpagepte in mm/gup.c in the Linux Kernel due to a race problem, which can poison the page table entry, and cause denial-of-service problem.
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/commit/?id=fac35ba763ed07ba93154c95ffc0c4a55023707f
Other sources
A vulnerability was found in followpagepte in mm/gup.c in the Linux Kernel. This issue occurs due to a race problem which can poison the page table entry and cause a denial-of-service.
A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function followpagepte of the file mm/gup.c of the component BPF. The manipulation leads to race condition. The attack can be launched remotely. It is recommended to apply a patch to fix this issue. The identifier VDB-211921 was assigned to this vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-477.10.1.rt7.274.el8_8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-477.10.1.el8_8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:5.14.0-284.11.1.el9_2 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:5.14.0-284.11.1.rt14.296.el9_2 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch fac35ba763ed07ba93154c95ffc0c4a55023707f
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2022-3623?
CVE-2022-3623 is classified as a denial-of-service vulnerability due to a race condition in the Linux Kernel.
How do I fix CVE-2022-3623?
To fix CVE-2022-3623, update your Linux Kernel to kernel-rt versions 0:4.18.0-477.10.1.rt7.274.el8_8 or 0:5.14.0-284.11.1.rt14.296.el9_2, or apply applicable updates from your distribution.
Which Linux Kernel versions are affected by CVE-2022-3623?
CVE-2022-3623 affects Linux Kernel versions 5.1 up to 5.4.228, 5.5 up to 5.10.159, 5.11 up to 5.15.78, and 5.16 up to 5.19.17.
What impact does CVE-2022-3623 have on systems?
The primary impact of CVE-2022-3623 is that it can lead to denial-of-service situations due to poisoned page table entries.
Is CVE-2022-3623 exploitable remotely?
Yes, CVE-2022-3623 is exploitable remotely under certain conditions, posing significant risk to vulnerable systems.