Critical Vulnerability in Linux Kernel: Call Trace Issue with CMF Enabled
Summary
CVE-2022-49537: In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix call trace observed during I/O with CMF enabled The following was seen with CMF enabled: BUG: using smp_processor_id() in preemptible co... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interactions. It is known for its robustness, flexibility, and extensive support for various hardware architectures. However, it is also susceptible to vulnerabilities that can affect system stability and security. The specific vulnerability identified as CVE-2022-49537 relates to the lpfc driver, which handles Fibre Channel communications, and can lead to system crashes when the Command Management Framework (CMF) is enabled.
Vulnerability Detail
CVE-2022-49537 is a vulnerability in the Linux kernel that arises from the improper use of the smp_processor_id() function in a preemptible context. This issue can lead to call traces during I/O operations when CMF is enabled, potentially causing system instability and crashes. The vulnerability was observed in the lpfc driver, where the function lpfc_update_cmf_cmd calls smp_processor_id, which is not safe in preemptible code. This can result in unexpected behavior and system errors, particularly affecting services reliant on the lpfc driver.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, disabling CMF may prevent the issue from occurring until the system can be updated.
Conclusion
CVE-2022-49537 is a critical vulnerability in the Linux kernel that can lead to system instability when using the lpfc driver with CMF enabled. Users are advised to update their systems to the latest patched versions to mitigate this risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49537 is a vulnerability in the Linux kernel related to the improper use of the smp_processor_id() function in a preemptible context, leading to potential system crashes.
The vulnerability affects various versions of the Linux kernel across Debian 11, 12, and 13, particularly when using the lpfc driver with CMF enabled.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check if your application is affected by this vulnerability.
If immediate updates are not possible, consider disabling the Command Management Framework (CMF) to mitigate the risk until a patch can be applied.
Detailed information about CVE-2022-49537 can be found in the official CVE database and security advisories from the Linux kernel maintainers.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
