CVE-2022-49895: cxl/region: Fix decoder allocation crash
In the Linux kernel, the following vulnerability has been resolved:
cxl/region: Fix decoder allocation crash
When an intermediate port's decoders have been exhausted by existing regions, and creating a new region with the port in question in it's hierarchical path is attempted, cxlportattachregion() fails to find a port decoder (as would be expected), and drops into the failure / cleanup path.
However, during cleanup of the region reference, a sanity check attempts to dereference the decoder, which in the above case didn't exist. This causes a NULL pointer dereference BUG.
To fix this, refactor the decoder allocation and de-allocation into helper routines, and in this 'free' routine, check that the decoder, @cxld, is valid before attempting any operations on it.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-49895?
CVE-2022-49895 is classified as a medium severity vulnerability in the Linux kernel.
What does CVE-2022-49895 affect?
CVE-2022-49895 affects the Linux kernel's handling of CXL region decoders.
How do I fix CVE-2022-49895?
To fix CVE-2022-49895, update your Linux kernel to the latest stable version that addresses this vulnerability.
What is the nature of the vulnerability in CVE-2022-49895?
CVE-2022-49895 involves a crash during decoder allocation when creating new regions in an exhausted port.
Does CVE-2022-49895 allow for remote exploitation?
CVE-2022-49895 does not appear to directly allow for remote exploitation but can impact system stability.