CVE-2022-49931: IB/hfi1: Correctly move list in sc_disable()
In the Linux kernel, the following vulnerability has been resolved:
IB/hfi1: Correctly move list in scdisable()
Commit 13bac861952a ("IB/hfi1: Fix abba locking issue with scdisable()") incorrectly tries to move a list from one list head to another. The result is a kernel crash.
The crash is triggered when a link goes down and there are waiters for a send to complete. The following signature is seen:
BUG: kernel NULL pointer dereference, address: 0000000000000030 [...] Call Trace: scdisable+0x1ba/0x240 [hfi1] piofreeze+0x3d/0x60 [hfi1] handlefreeze+0x27/0x1b0 [hfi1] processonework+0x1b0/0x380 ? processonework+0x380/0x380 workerthread+0x30/0x360 ? processonework+0x380/0x380 kthread+0xd7/0x100 ? kthreadcompleteandexit+0x20/0x20 retfromfork+0x1f/0x30
The fix is to use the correct call to move the list.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch 13bac861952a - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch IB/hfi1: Fix abba locking issue with sc_disable() - Compensating control
If systems are affected by kernel NULL pointer dereference on link-down in IB/hfi1, use an external mitigation such as temporarily disabling the IB/hfi1 functionality or isolating hosts until the kernel fix containing commit 13bac861952a is applied.
Event History
Frequently Asked Questions
What is the severity of CVE-2022-49931?
CVE-2022-49931 has been classified with a high severity due to its potential to cause kernel crashes.
How do I fix CVE-2022-49931?
To fix CVE-2022-49931, upgrade your Linux kernel to the latest version where the vulnerability has been addressed.
What systems are affected by CVE-2022-49931?
CVE-2022-49931 affects various distributions of the Linux kernel.
What type of vulnerability is CVE-2022-49931?
CVE-2022-49931 is a kernel vulnerability related to incorrect list handling in the IB/hfi1 driver.
What are the implications of CVE-2022-49931 for users?
Users may experience system instability and crashes if they do not address CVE-2022-49931.