Concurrent Write Vulnerability in Linux Kernel's IO Cost QoS Management
Summary
CVE-2022-50086: In the Linux kernel, the following vulnerability has been resolved: block: don't allow the same type rq_qos add more than once In our test of iocost, we encountered some list add/del corruptions of inner_walk list in ioc... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management, process scheduling, and system calls. It is known for its robustness and flexibility, supporting a wide range of hardware architectures. This vulnerability specifically affects the IO cost quality of service (QoS) management, which is responsible for managing disk I/O operations to ensure fair resource allocation among processes. The vulnerability arises from concurrent writes to the IO cost QoS file, leading to potential corruption of internal data structures.
Vulnerability Detail
The vulnerability, identified as CVE-2022-50086, occurs when two CPUs attempt to write to the io.cost.qos file simultaneously. This can result in the same request QoS (rq_qos) being added multiple times to a single disk, leading to multiple instances of IO cost management running concurrently. The overlapping instances can corrupt the internal data structures, specifically the inner_walk list, causing instability and potential crashes in the system. This issue is particularly critical as it undermines the integrity of the disk I/O management, which can lead to data loss or system failures.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, avoiding concurrent writes to the io.cost.qos file from multiple CPUs can help mitigate the risk until the system is updated.
Conclusion
CVE-2022-50086 is a significant vulnerability in the Linux kernel that can lead to data corruption due to concurrent writes in the IO cost QoS management. It is crucial for users to update their systems to the patched versions to mitigate the risks associated with this vulnerability. Monitoring tools like Vulert can assist in identifying vulnerabilities in your applications.
See every vulnerability recorded for linux →
FAQ
CVE-2022-50086 is a vulnerability in the Linux kernel that allows for concurrent writes to the IO cost QoS management, potentially leading to data corruption.
This vulnerability can cause instability in disk I/O management, leading to possible data loss or system crashes due to corrupted internal data structures.
The vulnerability affects various versions of the Linux kernel, particularly those used in Debian 11, 12, and 13.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file. Visit Vulert Scanner to check for vulnerabilities without needing to sign up.
If an immediate update is not possible, try to minimize concurrent writes to the io.cost.qos file to reduce the risk of triggering the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
