Critical Vulnerability in Linux Kernel: VMCI Tasklet Deadlock Issue
Summary
CVE-2022-49759: In the Linux kernel, the following vulnerability has been resolved: VMCI: Use threaded irqs instead of tasklets The vmci_dispatch_dgs() tasklet function calls vmci_read_data() which uses wait_event() resulting in invalid... Affects linux versions < 6.1.8-1. Fixed in 6.1.8-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It is known for its robustness and versatility, supporting a wide range of devices and applications. However, vulnerabilities can arise, such as the one identified in the VMCI (Virtual Machine Communication Interface) component, which can lead to potential deadlocks and system instability.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the VMCI component where the vmci_dispatch_dgs() tasklet function calls vmci_read_data(), which uses wait_event(). This results in an invalid sleep in an atomic context, potentially leading to a deadlock situation. The issue arises from the use of tasklets instead of threaded interrupts, which can cause the system to hang under certain conditions. The vulnerability is particularly concerning as it can affect the stability of systems relying on the VMCI for communication between virtual machines.
How To Fix
Minimum fixed version
6.1.8-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the VMCI component until the kernel is updated. However, this may limit certain functionalities related to virtual machine communication.
Conclusion
The vulnerability identified in the Linux kernel's VMCI component poses significant risks to system stability due to potential deadlocks. It is crucial for users to update their systems to the patched version to mitigate these risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to system deadlocks, causing instability and potential crashes in systems utilizing the VMCI component.
You can use tools like Vulert, which monitors open-source vulnerabilities in real-time. Simply upload your manifest file to check for vulnerabilities.
Yes, a patch is available in version 6.1.8-1 of the Linux kernel. Updating to this version will resolve the issue.
As a temporary measure, avoid using the VMCI component until you can apply the update.
Detailed information can be found in the CVE database and through security advisories related to the Linux kernel.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
