CVE-2022-49726: clocksource: hyper-v: unexport __init-annotated hv_init_clocksource()
In the Linux kernel, the following vulnerability has been resolved:
clocksource: hyper-v: unexport init-annotated hvinitclocksource()
EXPORTSYMBOL and init is a bad combination because the .init.text section is freed up after the initialization. Hence, modules cannot use symbols annotated init. The access to a freed symbol may end up with kernel panic.
modpost used to detect it, but it has been broken for a decade.
Recently, I fixed modpost so it started to warn it again, then this showed up in linux-next builds.
There are two ways to fix it:
- Remove init - Remove EXPORTSYMBOL
I chose the latter for this case because the only in-tree call-site, arch/x86/kernel/cpu/mshyperv.c is never compiled as modular. (CONFIGHYPERVISORGUEST is boolean)
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-49726?
CVE-2022-49726 has a medium severity rating due to its potential impact on the Linux kernel’s stability.
How do I fix CVE-2022-49726?
To fix CVE-2022-49726, ensure your Linux kernel is updated to the latest version that contains the security patch.
What systems are affected by CVE-2022-49726?
CVE-2022-49726 affects various versions of the Linux kernel.
What are the risks associated with CVE-2022-49726?
The risks of CVE-2022-49726 include potential instability and issues with module dependencies in the Linux kernel.
When was CVE-2022-49726 reported?
CVE-2022-49726 was reported in late 2022 following an internal review of the Linux kernel's clocksource management.