CVE-2022-49709: cfi: Fix __cfi_slowpath_diag RCU usage with cpuidle
In the Linux kernel, the following vulnerability has been resolved:
cfi: Fix cfislowpathdiag RCU usage with cpuidle
RCUNONIDLE usage during cfislowpathdiag can result in an invalid RCU state in the cpuidle code path:
WARNING: CPU: 1 PID: 0 at kernel/rcu/tree.c:613 rcueqsenter+0xe4/0x138 ... Call trace: rcueqsenter+0xe4/0x138 rcuidleenter+0xa8/0x100 cpuidleenterstate+0x154/0x3a8 cpuidleenter+0x3c/0x58 doidle.llvm.6590768638138871020+0x1f4/0x2ec cpustartupentry+0x28/0x2c secondarystartkernel+0x1b8/0x220 secondaryswitched+0x94/0x98
Instead, call rcuirqenter/exit to wake up RCU only when needed and disable interrupts for the entire CFI shadow/module check when we do.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-49709?
CVE-2022-49709 has been classified as a medium severity vulnerability.
How do I fix CVE-2022-49709?
To fix CVE-2022-49709, it is recommended to upgrade to the latest version of the Linux kernel that includes the fix.
What does CVE-2022-49709 affect?
CVE-2022-49709 affects the Linux kernel, specifically related to RCU usage in the cpuidle code path.
What are the consequences of not addressing CVE-2022-49709?
Not addressing CVE-2022-49709 could lead to potential instability or incorrect behavior in the Linux kernel's scheduling.
Is CVE-2022-49709 under active exploitation?
There is currently no evidence that CVE-2022-49709 is actively being exploited in the wild.