CVE-2022-50171: crypto: hisilicon/sec - don't sleep when in softirq
In the Linux kernel, the following vulnerability has been resolved:
crypto: hisilicon/sec - don't sleep when in softirq
When kunpeng920 encryption driver is used to deencrypt and decrypt packets during the softirq, it is not allowed to use mutex lock. The kernel will report the following error:
BUG: scheduling while atomic: swapper/57/0/0x00000300 Call trace: dumpbacktrace+0x0/0x1e4 showstack+0x20/0x2c dumpstack+0xd8/0x140 schedulebug+0x68/0x80 schedule+0x728/0x840 schedule+0x50/0xe0 schedulepreemptdisabled+0x18/0x24 mutexlock.constprop.0+0x594/0x5dc mutexlockslowpath+0x1c/0x30 mutexlock+0x50/0x60 secrequestinit+0x8c/0x1a0 [hisisec2] secprocess+0x28/0x1ac [hisisec2] secskciphercrypto+0xf4/0x1d4 [hisisec2] secskcipherencrypt+0x1c/0x30 [hisisec2] cryptoskcipherencrypt+0x2c/0x40 cryptoauthencencrypt+0xc8/0xfc [authenc] cryptoaeadencrypt+0x2c/0x40 echainivencrypt+0x144/0x1a0 [echainiv] cryptoaeadencrypt+0x2c/0x40 espoutputtail+0x348/0x5c0 [esp4] espoutput+0x120/0x19c [esp4] xfrmoutputone+0x25c/0x4d4 xfrmoutputresume+0x6c/0x1fc xfrmoutput+0xac/0x3c0 xfrm4output+0x64/0x130 ipbuildandsendpkt+0x158/0x20c tcpv4sendsynack+0xdc/0x1f0 tcpconnrequest+0x7d0/0x994 tcpv4connrequest+0x58/0x6c tcpv6connrequest+0xf0/0x100 tcprcvstateprocess+0x1cc/0xd60 tcpv4dorcv+0x10c/0x250 tcpv4rcv+0xfc4/0x10a4 ipprotocoldeliverrcu+0xf4/0x200 iplocaldeliverfinish+0x58/0x70 iplocaldeliver+0x68/0x120 ipsublistrcvfinish+0x70/0x94 iplistrcvfinish.constprop.0+0x17c/0x1d0 ipsublistrcv+0x40/0xb0 iplistrcv+0x140/0x1dc netifreceiveskblistcore+0x154/0x28c netifreceiveskblist+0x120/0x1a0 netifreceiveskblistinternal+0xe4/0x1f0 napicompletedone+0x70/0x1f0 grocellpoll+0x9c/0xb0 napipoll+0xcc/0x264 netrxaction+0xd4/0x21c dosoftirq+0x130/0x358 irqexit+0x11c/0x13c handledomainirq+0x88/0xf0 gichandleirq+0x78/0x2c0 el1irq+0xb8/0x140 archcpuidle+0x18/0x40 defaultidlecall+0x5c/0x1c0 cpuidleidlecall+0x174/0x1b0 doidle+0xc8/0x160 cpustartupentry+0x30/0x11c secondarystartkernel+0x158/0x1e4 softirq: huh, entered softirq 3 NETRX 0000000093774ee4 with preemptcount 00000100, exited with fffffe00?
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.0.2-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
ubuntu/linux-aws-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1023.27~20.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1023.29~20.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1022.29~20.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-53.59~20.04.1 - Upgrade
Upgrade
ubuntu/linux-intel-iotg-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1018.23~20.04.1 - Upgrade
Upgrade
ubuntu/linux-lowlatency-hwe-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-53.59~20.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1022.28~20.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1023.27~20.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 5.15.0-53.59 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 5.15.0-1023.27 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 5.15.0-1023.29 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 5.15.0-1024.30.1 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 5.15.0-1022.29 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 5.15.0-1020.25 - Upgrade
Upgrade
ubuntu/linux-gkeopto a version that resolves this vulnerability.Fixed in 5.15.0-1008.12 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 5.15.0-1018.21 - Upgrade
Upgrade
ubuntu/linux-intel-iotgto a version that resolves this vulnerability.Fixed in 5.15.0-1018.23 - Upgrade
Upgrade
ubuntu/linux-kvmto a version that resolves this vulnerability.Fixed in 5.15.0-1021.26 - Upgrade
Upgrade
ubuntu/linux-lowlatencyto a version that resolves this vulnerability.Fixed in 5.15.0-53.59 - Upgrade
Upgrade
ubuntu/linux-nvidiato a version that resolves this vulnerability.Fixed in 5.15.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 5.15.0-1022.28 - Upgrade
Upgrade
ubuntu/linux-raspito a version that resolves this vulnerability.Fixed in 5.15.0-1018.20 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 5.15.0-1025.28
Event History
Frequently Asked Questions
What is the severity of CVE-2022-50171?
CVE-2022-50171 is classified as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2022-50171?
To fix CVE-2022-50171, update your Linux kernel to the latest stable version where the vulnerability has been patched.
What components are affected by CVE-2022-50171?
CVE-2022-50171 affects the kunpeng920 encryption driver in the Linux kernel.
Can CVE-2022-50171 lead to denial of service?
Yes, exploiting CVE-2022-50171 could potentially lead to denial of service due to inappropriate mutex handling.
Is CVE-2022-50171 specific to any Linux distribution?
CVE-2022-50171 is not specific to any Linux distribution as it is related to the Linux kernel itself.