RCU Priority Boosting Failure in Linux Kernel - CVE-2022-50177
Summary
CVE-2022-50177: In the Linux kernel, the following vulnerability has been resolved: rcutorture: Fix ksoftirqd boosting timing and iteration The RCU priority boosting can fail in two situations: 1) If (nr_cpus= > maxcpus=), which means i... Affects linux versions < 6.0.2-1. Fixed in 6.0.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware management and system resources. It is known for its stability, performance, and scalability. However, vulnerabilities can arise, impacting system performance and security. CVE-2022-50177 specifically affects the RCU (Read-Copy-Update) mechanism, which is crucial for managing concurrent access to shared data structures.
Vulnerability Detail
CVE-2022-50177 is a vulnerability in the Linux kernel related to the RCU priority boosting mechanism. It can fail under two conditions: first, if the number of CPUs exceeds those brought online at boot, leading to a failure in boosting ksoftirqd threads for newly online CPUs. Second, the timing of boosting ksoftirqd threads after the creation of rcu_torture_boost threads creates a race condition, allowing these threads to wait for ksoftirqds running at a lower priority. This can lead to performance degradation and system instability, especially under high load conditions.
How To Fix
Minimum fixed version
6.0.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can avoid running configurations that trigger the vulnerability, such as using the command './kvm.sh --configs TREE01 --kconfig "CONFIG_RCU_BOOST=y"'. However, this does not eliminate the underlying issue and should only be considered until a proper fix is applied.
Conclusion
CVE-2022-50177 is a significant vulnerability in the Linux kernel that can impact system performance due to issues with the RCU priority boosting mechanism. It is crucial to apply the necessary updates to mitigate this risk and ensure system stability.
See every vulnerability recorded for linux →
FAQ
CVE-2022-50177 is a vulnerability in the Linux kernel that affects the RCU priority boosting mechanism, potentially leading to performance issues.
The vulnerability can cause ksoftirqd threads to not receive priority boosts, leading to delays and potential system instability under high load.
The vulnerability affects Linux kernel versions prior to 6.0.2-1 on Debian-based systems.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider applying the suggested workaround and monitor your system for any unusual behavior.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
