CVE-2022-49641: sysctl: Fix data races in proc_douintvec().
In the Linux kernel, the following vulnerability has been resolved:
sysctl: Fix data races in procdouintvec().
A sysctl variable is accessed concurrently, and there is always a chance of data-race. So, all readers and writers need some basic protection to avoid load/store-tearing.
This patch changes procdouintvec() to use READONCE() and WRITEONCE() internally to fix data-races on the sysctl side. For now, procdouintvec() itself is tolerant to a data-race, but we still need to add annotations on the other subsystem's side.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-49641?
CVE-2022-49641 is classified as a moderate severity vulnerability due to potential data races in the Linux kernel.
How do I fix CVE-2022-49641?
To mitigate CVE-2022-49641, update your Linux kernel to a version that has resolved this vulnerability per the security advisories.
What are the affected versions for CVE-2022-49641?
CVE-2022-49641 affects multiple versions of the Linux kernel, specifically versions between 4.4.24 and 5.19-rc6.
What is the impact of CVE-2022-49641 on Linux systems?
The impact of CVE-2022-49641 includes potential data corruption or system instability due to concurrent access to sysctl variables.
Is CVE-2022-49641 exploited in the wild?
As of now, there are no reported instances of CVE-2022-49641 being actively exploited in the wild.