Kernel Panic Risk in Linux Package Due to UXN Setting Issue
Summary
CVE-2022-50232: In the Linux kernel, the following vulnerability has been resolved: arm64: set UXN on swapper page tables [ This issue was fixed upstream by accident in c3cee924bd85 ("arm64: head: cover entire kernel image in initial ID... Affects linux versions < 5.16.7-1. Fixed in 5.16.7-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the operating system that manages hardware and system resources. It is known for its stability, performance, and flexibility, serving as the foundation for various distributions, including Debian. This vulnerability affects the arm64 architecture, specifically related to the handling of user-executable non-executable (UXN) settings on swapper page tables, which can lead to system instability.
Vulnerability Detail
The vulnerability, identified as CVE-2022-50232, arises from the failure to set UXN on swapper page tables in systems implementing FEAT_EPAN. This oversight allows unauthorized read/write access to the idmap, leading to potential kernel panics during operations involving idmap_kpti_install_ng_mappings. The issue was inadvertently addressed in a prior commit but requires a dedicated fix for stable backporting.
How To Fix
Minimum fixed version
5.16.7-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it becomes available.
Conclusion
CVE-2022-50232 presents a significant risk to systems running affected versions of the Linux kernel, particularly in the arm64 architecture. Immediate action is recommended to update to the patched version to prevent potential kernel panics and ensure system stability.
See every vulnerability recorded for linux →
FAQ
CVE-2022-50232 is a vulnerability in the Linux kernel related to the improper setting of UXN on swapper page tables, which can cause kernel panics.
The vulnerability affects Linux versions prior to 5.16.7-1 in Debian 12 and 13.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
While there are no specific workarounds, it is crucial to plan for an update to mitigate the risk of kernel panics.
Detailed information can be found in the official CVE database and through security advisories related to the Linux kernel.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
