CVE-2022-50206: arm64: fix oops in concurrently setting insn_emulation sysctls
In the Linux kernel, the following vulnerability has been resolved:
arm64: fix oops in concurrently setting insnemulation sysctls
emulationprochandler() changes table->data for procdointvecminmax and can generate the following Oops if called concurrently with itself:
| Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010 | Internal error: Oops: 96000006 [#1] SMP | Call trace: | updateinsnemulationmode+0xc0/0x148 | emulationprochandler+0x64/0xb8 | procsyscallhandler+0x9c/0xf8 | procsyswrite+0x18/0x20 | vfswrite+0x20/0x48 | vfswrite+0xe4/0x1d0 | ksyswrite+0x70/0xf8 | arm64syswrite+0x20/0x28 | el0svccommon.constprop.0+0x7c/0x1c0 | el0svchandler+0x2c/0xa0 | el0svc+0x8/0x200
To fix this issue, keep the table->data as &insn->currentmode and use containerof() to retrieve the insn pointer. Another mutex is used to protect against the currentmode update but not for retrieving insnemulation as table->data is no longer changing.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-50206?
CVE-2022-50206 is classified as a moderate severity vulnerability.
How do I fix CVE-2022-50206?
To fix CVE-2022-50206, ensure that the Linux kernel is updated to the latest version where this issue is patched.
What systems are affected by CVE-2022-50206?
CVE-2022-50206 affects the Linux kernel, specifically on arm64 architectures.
What does CVE-2022-50206 vulnerability do?
CVE-2022-50206 can cause a kernel oops when the insn_emulation sysctls are set concurrently.
Is there a workaround for CVE-2022-50206?
Currently, there are no known workarounds for CVE-2022-50206 aside from updating the kernel.