Critical RCU Protection Flaw in Linux Kernel Bonding Module
Summary
CVE-2022-49456: In the Linux kernel, the following vulnerability has been resolved: bonding: fix missed rcu protection When removing the rcu_read_lock in bond_ethtool_get_ts_info() as discussed [1], I didn't notice it could be called vi... Affects linux versions < 5.18.5-1. Fixed in 5.18.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of many operating systems, managing hardware and system resources. It includes various modules, one of which is the bonding module that allows multiple network interfaces to be combined into a single logical interface for redundancy and increased throughput. This module is crucial for network reliability and performance. However, it has recently been identified that the bonding module lacks proper Read-Copy Update (RCU) protection in certain functions, leading to potential vulnerabilities.
Vulnerability Detail
The vulnerability, identified as CVE-2022-49456, arises from the removal of the rcu_read_lock in the bond_ethtool_get_ts_info() function. This function can be invoked via setsockopt, which does not hold the RCU lock, potentially leading to race conditions and undefined behavior. The vulnerability was highlighted by syzbot, which provided a stack trace indicating the issue. If exploited, this could lead to system instability or crashes, affecting the overall reliability of the network services provided by the Linux kernel.
How To Fix
Minimum fixed version
5.18.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
The vulnerability CVE-2022-49456 in the Linux kernel's bonding module poses a significant risk due to inadequate RCU protection. Users are advised to update to the patched version to mitigate potential impacts on system stability and network performance. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49456 is a vulnerability in the Linux kernel's bonding module that lacks proper RCU protection, potentially leading to system instability.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
Exploitation of this vulnerability could lead to race conditions, resulting in system crashes or instability, affecting network performance.
You can update your Linux kernel using the command 'sudo apt-get update && sudo apt-get install linux' and then reboot your system.
Currently, there are no specific workarounds available. The recommended action is to apply the patch by updating the kernel.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
