Kernel Race Condition Vulnerability in Linux Package: CVE-2022-49201
Summary
CVE-2022-49201: In the Linux kernel, the following vulnerability has been resolved: ibmvnic: fix race between xmit and reset There is a race between reset and the transmit paths that can lead to ibmvnic_xmit() accessing an scrq after it... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the operating system that manages hardware resources and provides essential services for applications. It is known for its robustness and flexibility, supporting a wide range of devices and architectures. However, like any complex software, it can be susceptible to vulnerabilities. CVE-2022-49201 specifically affects the ibmvnic driver, which is responsible for virtual network interface card (NIC) operations in IBM Power Systems. This vulnerability arises from a race condition between the transmit and reset paths, potentially leading to system crashes.
Vulnerability Detail
CVE-2022-49201 is a race condition vulnerability in the ibmvnic driver of the Linux kernel. It occurs when the transmit path accesses a data structure (tx_scrq) that has been freed during a reset operation. This can lead to a NULL pointer dereference, causing the kernel to crash with errors indicating an attempt to read a user page or a bad memory access. The vulnerability is particularly dangerous as it can be exploited to disrupt network operations, leading to system instability and potential denial of service.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid triggering the vulnerability by ensuring that the ibmvnic driver is not in use during reset operations. This can be done by stopping the network interface before performing any reset actions. Use the following command to stop the interface: sudo ifdown <interface_name>, replacing <interface_name> with the actual name of the network interface.
Conclusion
CVE-2022-49201 is a critical vulnerability in the Linux kernel that can lead to system crashes due to a race condition in the ibmvnic driver. Users are strongly advised to update their kernel to the patched version to ensure system stability and security. Temporary workarounds are available, but they do not replace the need for a proper update.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49201 is a vulnerability in the Linux kernel's ibmvnic driver that can cause system crashes due to a race condition between transmit and reset operations.
You can use Vulert, a tool that monitors open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Symptoms may include kernel crashes, system instability, and network disruptions when the ibmvnic driver is in use.
Yes, a patch is available in the Linux kernel version 5.17.3-1 and later. Users should update their kernel to this version or newer.
If immediate updates are not possible, you can stop the network interface using the command 'sudo ifdown <interface_name>' to mitigate the risk temporarily.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
