CVE-2022-50504: powerpc/rtas: avoid scheduling in rtas_os_term()
In the Linux kernel, the following vulnerability has been resolved:
powerpc/rtas: avoid scheduling in rtasosterm()
It's unsafe to use rtasbusydelay() to handle a busy status from the ibm,os-term RTAS function in rtasosterm():
Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b BUG: sleeping function called from invalid context at arch/powerpc/kernel/rtas.c:618 inatomic(): 1, irqsdisabled(): 1, nonblock: 0, pid: 1, name: swapper/0 preemptcount: 2, expected: 0 CPU: 7 PID: 1 Comm: swapper/0 Tainted: G D 6.0.0-rc5-02182-gf8553a572277-dirty #9 Call Trace: [c000000007b8f000] [c000000001337110] dumpstacklvl+0xb4/0x110 (unreliable) [c000000007b8f040] [c0000000002440e4] mightresched+0x394/0x3c0 [c000000007b8f0e0] [c00000000004f680] rtasbusydelay+0x120/0x1b0 [c000000007b8f100] [c000000000052d04] rtasosterm+0xb8/0xf4 [c000000007b8f180] [c0000000001150fc] pseriespanic+0x50/0x68 [c000000007b8f1f0] [c000000000036354] ppcpanicplatformhandler+0x34/0x50 [c000000007b8f210] [c0000000002303c4] notifiercallchain+0xd4/0x1c0 [c000000007b8f2b0] [c0000000002306cc] atomicnotifiercallchain+0xac/0x1c0 [c000000007b8f2f0] [c0000000001d62b8] panic+0x228/0x4d0 [c000000007b8f390] [c0000000001e573c] doexit+0x140c/0x1420 [c000000007b8f480] [c0000000001e586c] maketaskdead+0xdc/0x200
Use rtasbusydelaytime() instead, which signals without side effects whether to attempt the ibm,os-term RTAS call again.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-50504?
CVE-2022-50504 has been assigned a high severity due to the potential for kernel panic and system instability.
How do I fix CVE-2022-50504?
To fix CVE-2022-50504, update to the latest version of the Linux kernel that includes the patch addressing this vulnerability.
What systems are affected by CVE-2022-50504?
CVE-2022-50504 affects the Linux kernel, particularly systems using the powerpc architecture.
What could happen if CVE-2022-50504 is exploited?
If exploited, CVE-2022-50504 can lead to a kernel panic, resulting in system crashes and data loss.
Is there a workaround for CVE-2022-50504?
There is no known workaround for CVE-2022-50504; applying the kernel update is the recommended mitigation.