CVE-2022-50494: thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash
In the Linux kernel, the following vulnerability has been resolved:
thermal: intelpowerclamp: Use getcpu() instead of smpprocessorid() to avoid crash
When CPU 0 is offline and intelpowerclamp is used to inject idle, it generates kernel BUG:
BUG: using smpprocessorid() in preemptible [00000000] code: bash/15687 caller is debugsmpprocessorid+0x17/0x20 CPU: 4 PID: 15687 Comm: bash Not tainted 5.19.0-rc7+ #57 Call Trace: <TASK> dumpstacklvl+0x49/0x63 dumpstack+0x10/0x16 checkpreemptiondisabled+0xdd/0xe0 debugsmpprocessorid+0x17/0x20 powerclampsetcurstate+0x7f/0xf9 [intelpowerclamp] ... ...
Here CPU 0 is the control CPU by default and changed to the current CPU, if CPU 0 offlined. This check has to be performed under cpusreadlock(), hence the above warning.
Use getcpu() instead of smpprocessorid() to avoid this BUG.
[ rjw: Subject edits ]
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-50494?
CVE-2022-50494 has a medium severity rating due to the potential for kernel crashes under specific conditions.
How does CVE-2022-50494 affect the Linux kernel?
CVE-2022-50494 affects the Linux kernel's intel_powerclamp functionality, potentially leading to crashes when CPU 0 is offline.
How do I fix CVE-2022-50494?
To fix CVE-2022-50494, update to a patched version of the Linux kernel that incorporates the fix for this vulnerability.
What are the symptoms of CVE-2022-50494?
Symptoms of CVE-2022-50494 include unexpected kernel panics or crashes related to the intel_powerclamp feature.
Is CVE-2022-50494 relevant to all Linux kernel versions?
CVE-2022-50494 specifically affects certain versions of the Linux kernel that utilize intel_powerclamp and may not be present in all versions.