CVE-2022-48922
published 2024-08-22CVE-2022-48922: In the Linux kernel, the following vulnerability has been resolved: riscv: fix oops caused by irqsoff latency tracer The trace_hardirqs_{on,off}() require the…
PriorityP421medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.21%
10.9th percentile
In the Linux kernel, the following vulnerability has been resolved:
riscv: fix oops caused by irqsoff latency tracer
The trace_hardirqs_{on,off}() require the caller to setup frame pointer
properly. This because these two functions use macro 'CALLER_ADDR1' (aka.
__builtin_return_address(1)) to acquire caller info. If the $fp is used
for other purpose, the code generated this macro (as below) could trigger
memory access fault.
0xffffffff8011510e : ld a1,-16(s0)
0xffffffff80115112 : ld s2,-8(a1) # ] restore_all+0x12/0x6e
This because the $fp(aka. $s0) register is not used as frame pointer in the
assembly entry code.
resume_kernel:
REG_L s0, TASK_TI_PREEMPT_COUNT(tp)
bnez s0, restore_all
REG_L s0, TASK_TI_FLAGS(tp)
andi s0, s0, _TIF_NEED_RESCHED
beqz s0, restore_all
call preempt_schedule_irq
j restore_all
To fix above issue, here we add one extra level wrapper for function
trace_hardirqs_{on,off}() so they can be safely called by low level entry
code.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.16.12-1 (bookworm) | linux 5.16.12-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 3c46979829824da5af8766d89fa877976bdae884 < 9e2dbc31e367d08ee299a0d8aeb498cb2e12a1c3 | 9e2dbc31e367d08ee299a0d8aeb498cb2e12a1c3 |
| linux | linux | >= 3c46979829824da5af8766d89fa877976bdae884 < 1851b9a467065b18ec2cba156eea345206df1c8f | 1851b9a467065b18ec2cba156eea345206df1c8f |
| linux | linux | >= 3c46979829824da5af8766d89fa877976bdae884 < b5e180490db4af8c0f80c4b65ee482d333d0e8ee | b5e180490db4af8c0f80c4b65ee482d333d0e8ee |
| linux | linux | >= 3c46979829824da5af8766d89fa877976bdae884 < 22e2100b1b07d6f5acc71cc1acb53f680c677d77 | 22e2100b1b07d6f5acc71cc1acb53f680c677d77 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.103-1 | 5.10.103-1 |
| linux | linux_kernel | >= 0 < 5.16.12-1 | 5.16.12-1 |
| linux | linux_kernel | >= 0 < 5.16.12-1 | 5.16.12-1 |
| linux | linux_kernel | >= 0 < 5.16.12-1 | 5.16.12-1 |
| linux | linux_kernel | >= 5.11 < 5.15.26 | 5.15.26 |
| linux | linux_kernel | >= 5.16 < 5.16.12 | 5.16.12 |
| linux | linux_kernel | >= 5.9 < 5.10.103 | 5.10.103 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: riscv: fix oops caused by irqsoff latency tracer
vendor_redhat·2024-08-22·CVSS 5.5
CVE-2022-48922 [MEDIUM] CWE-476 kernel: riscv: fix oops caused by irqsoff latency tracer
kernel: riscv: fix oops caused by irqsoff latency tracer
In the Linux kernel, the following vulnerability has been resolved:
riscv: fix oops caused by irqsoff latency tracer
The trace_hardirqs_{on,off}() require the caller to setup frame pointer
properly. This because these two functions use macro 'CALLER_ADDR1' (aka.
__builtin_return_address(1)) to acquire caller info. If the $fp is used
for other purpose, the code generated this macro (as below) could trigger
memory access fault.
0xffffffff8011510e : ld a1,-16(s0)
0xffffffff80115112 : ld s2,-8(a1) # ] restore_all+0x12/0x6e
This because the $fp(aka. $s0) register is not used as frame pointer in the
assembly entry code.
resume_kernel:
REG_L s0, TASK_TI_PREEMPT_COUNT(tp)
bnez s0, restore_all
REG_L s0, TASK_TI_FLAGS(tp)
andi s0, s0, _TIF_NE
Debian
CVE-2022-48922: linux - In the Linux kernel, the following vulnerability has been resolved: riscv: fix ...
vendor_debian·2022·CVSS 5.5
CVE-2022-48922 [MEDIUM] CVE-2022-48922: linux - In the Linux kernel, the following vulnerability has been resolved: riscv: fix ...
In the Linux kernel, the following vulnerability has been resolved: riscv: fix oops caused by irqsoff latency tracer The trace_hardirqs_{on,off}() require the caller to setup frame pointer properly. This because these two functions use macro 'CALLER_ADDR1' (aka. __builtin_return_address(1)) to acquire caller info. If the $fp is used for other purpose, the code generated this macro (as below) could trigger memory access fault. 0xffffffff8011510e : ld a1,-16(s0) 0xffffffff80115112 : ld s2,-8(a1) # ] restore_all+0x12/0x6e This because the $fp(aka. $s0) register is not used as frame pointer in the assembly entry code. resume_kernel: REG_L s0, TASK_TI_PREEMPT_COUNT(tp) bnez s0, restore_all REG_L s0, TASK_TI_FLAGS(tp) andi s0, s0, _TIF_NEED_RESCHED beqz s0, restore_all call preempt_schedule_irq
OSV
CVE-2022-48922: In the Linux kernel, the following vulnerability has been resolved: riscv: fix oops caused by irqsoff latency tracer The trace_hardirqs_{on,off}() req
osv·2024-08-22·CVSS 5.5
CVE-2022-48922 [MEDIUM] CVE-2022-48922: In the Linux kernel, the following vulnerability has been resolved: riscv: fix oops caused by irqsoff latency tracer The trace_hardirqs_{on,off}() req
In the Linux kernel, the following vulnerability has been resolved: riscv: fix oops caused by irqsoff latency tracer The trace_hardirqs_{on,off}() require the caller to setup frame pointer properly. This because these two functions use macro 'CALLER_ADDR1' (aka. __builtin_return_address(1)) to acquire caller info. If the $fp is used for other purpose, the code generated this macro (as below) could trigger memory access fault. 0xffffffff8011510e : ld a1,-16(s0) 0xffffffff80115112 : ld s2,-8(a1) # ] restore_all+0x12/0x6e This because the $fp(aka. $s0) register is not used as frame pointer in the assembly entry code. resume_kernel: REG_L s0, TASK_TI_PREEMPT_COUNT(tp) bnez s0, restore_all REG_L s0, TASK_TI_FLAGS(tp) andi s0, s0, _TIF_NEED_RESCHED beqz s0, restore_all call preempt_schedule_irq
GHSA
GHSA-cp82-8q86-pm99: In the Linux kernel, the following vulnerability has been resolved:
riscv: fix oops caused by irqsoff latency tracer
The trace_hardirqs_{on,off}() r
ghsa_unreviewed·2024-08-22
CVE-2022-48922 [MEDIUM] CWE-476 GHSA-cp82-8q86-pm99: In the Linux kernel, the following vulnerability has been resolved:
riscv: fix oops caused by irqsoff latency tracer
The trace_hardirqs_{on,off}() r
In the Linux kernel, the following vulnerability has been resolved:
riscv: fix oops caused by irqsoff latency tracer
The trace_hardirqs_{on,off}() require the caller to setup frame pointer
properly. This because these two functions use macro 'CALLER_ADDR1' (aka.
__builtin_return_address(1)) to acquire caller info. If the $fp is used
for other purpose, the code generated this macro (as below) could trigger
memory access fault.
0xffffffff8011510e : ld a1,-16(s0)
0xffffffff80115112 : ld s2,-8(a1) # ] restore_all+0x12/0x6e
This because the $fp(aka. $s0) register is not used as frame pointer in the
assembly entry code.
resume_kernel:
REG_L s0, TASK_TI_PREEMPT_COUNT(tp)
bnez s0, restore_all
REG_L s0, TASK_TI_FLAGS(tp)
andi s0, s0, _TIF_NEED_RESCHED
beqz s0, restore_all
call preempt_schedule
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-08-22
Published