Kernel Panic Vulnerability in Linux Package: CVE-2022-49353
Summary
CVE-2022-49353: In the Linux kernel, the following vulnerability has been resolved: powerpc/papr_scm: don't requests stats with '0' sized stats buffer Sachin reported [1] that on a POWER-10 lpar he is seeing a kernel panic being reporte... Affects linux versions < 5.18.5-1. Fixed in 5.18.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the Linux operating system, responsible for managing hardware resources and providing essential services to software applications. It supports a wide range of hardware architectures and is known for its stability and performance. However, vulnerabilities can arise due to complex interactions between hardware and software, as seen in CVE-2022-49353, which affects the powerpc/papr_scm subsystem.
Vulnerability Detail
CVE-2022-49353 is a vulnerability in the Linux kernel that can lead to a kernel panic when the papr_scm probe is called with a zero-sized stats buffer. This issue was reported by Sachin on a POWER-10 logical partition (lpar) where the kernel attempted to write to a user page, resulting in a NULL pointer dereference. The panic occurs specifically when the 'Enable Performance Information Collection' option is disabled in the Hardware Management Console (HMC). The root cause is a missing check for the 'stat_buffer_len' parameter, which indicates whether the NVDIMM supports performance statistics. If this check is not implemented, it can lead to severe system instability and crashes.
How To Fix
Minimum fixed version
5.18.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can enable the 'Performance Information Collection' option in the HMC to avoid triggering the kernel panic. However, this is not a permanent solution and updating the package is recommended.
Conclusion
CVE-2022-49353 is a critical vulnerability in the Linux kernel that can lead to kernel panics under specific conditions. It is essential to update to the patched version to ensure system stability and security. Temporary workarounds can mitigate the issue, but a permanent fix through updates is strongly recommended.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49353 is a vulnerability in the Linux kernel that can cause a kernel panic due to a NULL pointer dereference when performance statistics are requested with an invalid buffer size.
If your system is running a vulnerable version of the Linux kernel, it may experience crashes or instability when the papr_scm probe is invoked under specific conditions.
If you cannot update your kernel, consider enabling the 'Performance Information Collection' option in the HMC as a temporary workaround to prevent kernel panics.
More information can be found in the official CVE database or by reviewing the Linux kernel mailing list discussions related to CVE-2022-49353.
Vulert allows you to monitor and alert in real-time for open-source vulnerabilities using a manifest file like package-lock.json. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
