Kernel Vulnerability in Linux Package: RDMA/irdma Context Bug
Summary
CVE-2022-49606: In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix sleep from invalid context BUG Taking the qos_mutex to process RoCEv2 QP's on netdev events causes a kernel splat. Affects linux versions < 5.18.16-1. Fixed in 5.18.16-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services and managing hardware resources. It supports various functionalities, including networking, file systems, and process management. The RDMA (Remote Direct Memory Access) subsystem allows for high-throughput, low-latency networking, particularly beneficial in data centers and high-performance computing. This vulnerability specifically affects the irdma driver, which is part of the RDMA subsystem, leading to potential system instability under certain conditions.
Vulnerability Detail
The vulnerability, identified as CVE-2022-49606, arises from improper handling of mutex locks in the RDMA/irdma driver. When processing RoCEv2 (RDMA over Converged Ethernet) queue pairs during netdev events, the qos_mutex is incorrectly acquired, leading to a kernel panic (splat) due to a sleeping function being called from an invalid context. This can result in system crashes and instability, particularly affecting systems utilizing RDMA technology for networking.
How To Fix
Minimum fixed version
5.18.16-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
CVE-2022-49606 is a significant vulnerability in the Linux kernel's RDMA/irdma driver that can lead to system instability. Users are advised to update to the patched version to mitigate potential risks. Monitoring tools like Vulert can assist in identifying vulnerabilities in your applications.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49606 is a vulnerability in the Linux kernel's RDMA/irdma driver that can cause kernel panics due to improper mutex handling.
This vulnerability can lead to system crashes and instability, particularly for systems using RDMA technology for networking.
Yes, a patch is available in version 5.18.16-1 of the Linux package. Users should update to this version to mitigate the vulnerability.
While there are no specific workarounds, it is advisable to monitor your system for unusual behavior and plan to apply the patch as soon as possible.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.