CVE-2022-49353 (GCVE-0-2022-49353)
Vulnerability from cvelistv5
Published
2025-02-26 02:11
Modified
2025-05-04 08:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
powerpc/papr_scm: don't requests stats with '0' sized stats buffer
Sachin reported [1] that on a POWER-10 lpar he is seeing a kernel panic being
reported with vPMEM when papr_scm probe is being called. The panic is of the
form below and is observed only with following option disabled(profile) for the
said LPAR 'Enable Performance Information Collection' in the HMC:
Kernel attempted to write user page (1c) - exploit attempt? (uid: 0)
BUG: Kernel NULL pointer dereference on write at 0x0000001c
Faulting instruction address: 0xc008000001b90844
Oops: Kernel access of bad area, sig: 11 [#1]
<snip>
NIP [c008000001b90844] drc_pmem_query_stats+0x5c/0x270 [papr_scm]
LR [c008000001b92794] papr_scm_probe+0x2ac/0x6ec [papr_scm]
Call Trace:
0xc00000000941bca0 (unreliable)
papr_scm_probe+0x2ac/0x6ec [papr_scm]
platform_probe+0x98/0x150
really_probe+0xfc/0x510
__driver_probe_device+0x17c/0x230
<snip>
---[ end trace 0000000000000000 ]---
Kernel panic - not syncing: Fatal exception
On investigation looks like this panic was caused due to a 'stat_buffer' of
size==0 being provided to drc_pmem_query_stats() to fetch all performance
stats-ids of an NVDIMM. However drc_pmem_query_stats() shouldn't have been called
since the vPMEM NVDIMM doesn't support and performance stat-id's. This was caused
due to missing check for 'p->stat_buffer_len' at the beginning of
papr_scm_pmu_check_events() which indicates that the NVDIMM doesn't support
performance-stats.
Fix this by introducing the check for 'p->stat_buffer_len' at the beginning of
papr_scm_pmu_check_events().
[1] https://lore.kernel.org/all/6B3A522A-6A5F-4CC9-B268-0C63AA6E07D3@linux.ibm.com
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/powerpc/platforms/pseries/papr_scm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e1295aab2ebcda1c1a9ed342baedc080e5c393e5",
"status": "affected",
"version": "b073096df4dec70d0436321b7093bad27ae91f9e",
"versionType": "git"
},
{
"lessThan": "07bf9431b1590d1cd7a8d62075d0b50b073f0495",
"status": "affected",
"version": "0e0946e22f3665d27325d389ff45ade6e93f3678",
"versionType": "git"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/powerpc/platforms/pseries/papr_scm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5.18.4",
"status": "affected",
"version": "5.18.3",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.18.4",
"versionStartIncluding": "5.18.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/papr_scm: don\u0027t requests stats with \u00270\u0027 sized stats buffer\n\nSachin reported [1] that on a POWER-10 lpar he is seeing a kernel panic being\nreported with vPMEM when papr_scm probe is being called. The panic is of the\nform below and is observed only with following option disabled(profile) for the\nsaid LPAR \u0027Enable Performance Information Collection\u0027 in the HMC:\n\n Kernel attempted to write user page (1c) - exploit attempt? (uid: 0)\n BUG: Kernel NULL pointer dereference on write at 0x0000001c\n Faulting instruction address: 0xc008000001b90844\n Oops: Kernel access of bad area, sig: 11 [#1]\n\u003csnip\u003e\n NIP [c008000001b90844] drc_pmem_query_stats+0x5c/0x270 [papr_scm]\n LR [c008000001b92794] papr_scm_probe+0x2ac/0x6ec [papr_scm]\n Call Trace:\n 0xc00000000941bca0 (unreliable)\n papr_scm_probe+0x2ac/0x6ec [papr_scm]\n platform_probe+0x98/0x150\n really_probe+0xfc/0x510\n __driver_probe_device+0x17c/0x230\n\u003csnip\u003e\n ---[ end trace 0000000000000000 ]---\n Kernel panic - not syncing: Fatal exception\n\nOn investigation looks like this panic was caused due to a \u0027stat_buffer\u0027 of\nsize==0 being provided to drc_pmem_query_stats() to fetch all performance\nstats-ids of an NVDIMM. However drc_pmem_query_stats() shouldn\u0027t have been called\nsince the vPMEM NVDIMM doesn\u0027t support and performance stat-id\u0027s. This was caused\ndue to missing check for \u0027p-\u003estat_buffer_len\u0027 at the beginning of\npapr_scm_pmu_check_events() which indicates that the NVDIMM doesn\u0027t support\nperformance-stats.\n\nFix this by introducing the check for \u0027p-\u003estat_buffer_len\u0027 at the beginning of\npapr_scm_pmu_check_events().\n\n[1] https://lore.kernel.org/all/6B3A522A-6A5F-4CC9-B268-0C63AA6E07D3@linux.ibm.com"
}
],
"providerMetadata": {
"dateUpdated": "2025-05-04T08:35:54.660Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e1295aab2ebcda1c1a9ed342baedc080e5c393e5"
},
{
"url": "https://git.kernel.org/stable/c/07bf9431b1590d1cd7a8d62075d0b50b073f0495"
}
],
"title": "powerpc/papr_scm: don\u0027t requests stats with \u00270\u0027 sized stats buffer",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2022-49353",
"datePublished": "2025-02-26T02:11:04.982Z",
"dateReserved": "2025-02-26T02:08:31.545Z",
"dateUpdated": "2025-05-04T08:35:54.660Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2022-49353\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-26T07:01:12.013\",\"lastModified\":\"2025-04-14T19:45:00.240\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\npowerpc/papr_scm: don\u0027t requests stats with \u00270\u0027 sized stats buffer\\n\\nSachin reported [1] that on a POWER-10 lpar he is seeing a kernel panic being\\nreported with vPMEM when papr_scm probe is being called. The panic is of the\\nform below and is observed only with following option disabled(profile) for the\\nsaid LPAR \u0027Enable Performance Information Collection\u0027 in the HMC:\\n\\n Kernel attempted to write user page (1c) - exploit attempt? (uid: 0)\\n BUG: Kernel NULL pointer dereference on write at 0x0000001c\\n Faulting instruction address: 0xc008000001b90844\\n Oops: Kernel access of bad area, sig: 11 [#1]\\n\u003csnip\u003e\\n NIP [c008000001b90844] drc_pmem_query_stats+0x5c/0x270 [papr_scm]\\n LR [c008000001b92794] papr_scm_probe+0x2ac/0x6ec [papr_scm]\\n Call Trace:\\n 0xc00000000941bca0 (unreliable)\\n papr_scm_probe+0x2ac/0x6ec [papr_scm]\\n platform_probe+0x98/0x150\\n really_probe+0xfc/0x510\\n __driver_probe_device+0x17c/0x230\\n\u003csnip\u003e\\n ---[ end trace 0000000000000000 ]---\\n Kernel panic - not syncing: Fatal exception\\n\\nOn investigation looks like this panic was caused due to a \u0027stat_buffer\u0027 of\\nsize==0 being provided to drc_pmem_query_stats() to fetch all performance\\nstats-ids of an NVDIMM. However drc_pmem_query_stats() shouldn\u0027t have been called\\nsince the vPMEM NVDIMM doesn\u0027t support and performance stat-id\u0027s. This was caused\\ndue to missing check for \u0027p-\u003estat_buffer_len\u0027 at the beginning of\\npapr_scm_pmu_check_events() which indicates that the NVDIMM doesn\u0027t support\\nperformance-stats.\\n\\nFix this by introducing the check for \u0027p-\u003estat_buffer_len\u0027 at the beginning of\\npapr_scm_pmu_check_events().\\n\\n[1] https://lore.kernel.org/all/6B3A522A-6A5F-4CC9-B268-0C63AA6E07D3@linux.ibm.com\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: powerpc/papr_scm: no solicita estad\u00edsticas con un b\u00fafer de estad\u00edsticas de tama\u00f1o \u00270\u0027 Sachin inform\u00f3 [1] que en un LPAR POWER-10 est\u00e1 viendo un p\u00e1nico del kernel que se informa con vPMEM cuando se llama a la sonda papr_scm. El p\u00e1nico tiene el formato siguiente y se observa solo con la siguiente opci\u00f3n deshabilitada (perfil) para dicho LPAR \u0027Habilitar recopilaci\u00f3n de informaci\u00f3n de rendimiento\u0027 en la HMC: El kernel intent\u00f3 escribir la p\u00e1gina del usuario (1c): \u00bfintento de explotaci\u00f3n? (uid: 0) ERROR: Desreferencia de puntero NULL del kernel al escribir en 0x0000001c Direcci\u00f3n de instrucci\u00f3n con error: 0xc008000001b90844 Oops: Acceso del kernel al \u00e1rea defectuosa, sig: 11 [#1] NIP [c008000001b90844] drc_pmem_query_stats+0x5c/0x270 [papr_scm] LR [c008000001b92794] papr_scm_probe+0x2ac/0x6ec [papr_scm] Seguimiento de llamadas: 0xc00000000941bca0 (no confiable) papr_scm_probe+0x2ac/0x6ec [papr_scm] platform_probe+0x98/0x150 really_probe+0xfc/0x510 __driver_probe_device+0x17c/0x230 ---[ fin del seguimiento 0000000000000000 ]--- P\u00e1nico del kernel: no se sincroniza: excepci\u00f3n fatal En la investigaci\u00f3n, parece que este p\u00e1nico se produjo debido a que se proporcion\u00f3 un \u0027stat_buffer\u0027 de tama\u00f1o==0 a drc_pmem_query_stats() para obtener todos los identificadores de estad\u00edsticas de rendimiento de un NVDIMM. Sin embargo, no se deber\u00eda haber llamado a drc_pmem_query_stats() ya que el NVDIMM vPMEM no admite ning\u00fan identificador de estad\u00edsticas de rendimiento. Esto se produjo debido a la falta de verificaci\u00f3n de \u0027p-\u0026gt;stat_buffer_len\u0027 al comienzo de papr_scm_pmu_check_events(), lo que indica que el NVDIMM no admite estad\u00edsticas de rendimiento. Solucione este problema introduciendo la comprobaci\u00f3n de \u0027p-\u0026gt;stat_buffer_len\u0027 al comienzo de papr_scm_pmu_check_events(). [1] https://lore.kernel.org/all/6B3A522A-6A5F-4CC9-B268-0C63AA6E07D3@linux.ibm.com\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.18.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1F3E9542-4AD8-4E33-8FFD-E0DC34E99EA1\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/07bf9431b1590d1cd7a8d62075d0b50b073f0495\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e1295aab2ebcda1c1a9ed342baedc080e5c393e5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}"
}
}