Critical Sleep-in-Atomic Bug in Linux Kernel - CVE-2022-49265
Summary
CVE-2022-49265: In the Linux kernel, the following vulnerability has been resolved: PM: domains: Fix sleep-in-atomic bug caused by genpd_debug_remove() When a genpd with GENPD_FLAG_IRQ_SAFE gets removed, the following sleep-in-atomic bu... Affects linux versions < 5.17.3-1. Fixed in 5.17.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, responsible for managing hardware resources and providing essential services to software applications. It is known for its stability, performance, and security features. However, vulnerabilities can arise, such as CVE-2022-49265, which affects the power management domain functionality, specifically when removing certain power management domains with specific flags.
Vulnerability Detail
CVE-2022-49265 is a sleep-in-atomic context bug that occurs when a power management domain (genpd) with the GENPD_FLAG_IRQ_SAFE flag is removed. The function genpd_debug_remove() is called while holding a spinlock, leading to a situation where a sleeping function is invoked from an invalid context. This can result in system instability or crashes, as it violates the kernel's locking mechanisms. The vulnerability was identified in the Linux kernel version 5.17.0-rc4+ and has been fixed in version 5.17.3-1.
How To Fix
Minimum fixed version
5.17.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the available patch as soon as possible.
Conclusion
CVE-2022-49265 is a significant vulnerability in the Linux kernel that can lead to system instability. It is essential to update to the patched version 5.17.3-1 to ensure the security and stability of your system. Regular monitoring for vulnerabilities using tools like Vulert can help maintain a secure environment.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49265 is a vulnerability in the Linux kernel that causes a sleep-in-atomic bug when removing certain power management domains.
This vulnerability can lead to system instability or crashes due to improper handling of kernel locking mechanisms.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
Yes, the vulnerability has been fixed in version 5.17.3-1 of the Linux package. It is recommended to update to this version or later.
While there are no specific workarounds, it is crucial to prioritize updating your system to mitigate the risk associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
