Critical Vulnerability in Linux Kernel Affecting Debian Packages: CVE-2022-50091
Summary
CVE-2022-50091: In the Linux kernel, the following vulnerability has been resolved: locking/csd_lock: Change csdlock_debug from early_param to setup The csdlock_debug kernel-boot parameter is parsed by the early_param() function csdlock... Affects linux versions < 6.0.2-1. Fixed in 6.0.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, including Debian. It manages system resources and hardware communication, providing essential services for software applications. This vulnerability, identified as CVE-2022-50091, affects the kernel's handling of the csd_lock_wait feature, which is crucial for managing concurrent operations in a multi-threaded environment. The issue arises from improper initialization sequences that can lead to system crashes.
Vulnerability Detail
CVE-2022-50091 is a vulnerability in the Linux kernel that occurs due to the early invocation of the early_param() function for the csdlock_debug kernel-boot parameter. When this parameter is set, it triggers the static_branch_enable() function, which can cause a panic on arm64 architectures when built with specific configurations (CONFIG_SPARSEMEM=y and CONFIG_SPARSEMEM_VMEMMAP=n). The vulnerability leads to a NULL dereference, resulting in system instability. Additionally, it affects powerpc architectures due to the timing of early_param() calls, which occur before the necessary initialization of jump labels, leading to warnings and potential failures.
How To Fix
Minimum fixed version
6.0.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating to the fixed version of the Linux kernel.
Conclusion
CVE-2022-50091 is a critical vulnerability in the Linux kernel that affects Debian packages, particularly on arm64 and powerpc architectures. It is essential to update to the patched version (6.0.2-1) to mitigate the risk of system crashes and instability. Regular monitoring and timely updates are crucial for maintaining system security.
See every vulnerability recorded for linux →
FAQ
CVE-2022-50091 is a vulnerability in the Linux kernel that can cause system crashes due to improper handling of the csd_lock_wait feature.
The vulnerability affects Debian systems running the Linux kernel with specific configurations, particularly arm64 and powerpc architectures.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
While there are no specific workarounds, it is recommended to monitor your system for any unusual behavior and plan for an update as soon as possible.
Yes, the vulnerability can lead to system crashes, which may result in data loss if not properly managed.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
