CVE-2022-49353

published 2025-02-26

CVE-2022-49353: In the Linux kernel, the following vulnerability has been resolved: powerpc/papr_scm: don't requests stats with '0' sized stats buffer Sachin reported [1] that…

Priority P4 21 medium 5.5 CVSS 3.1

AV L AC L PR L UI N S U C N I N A H

In the Linux kernel, the following vulnerability has been resolved:

powerpc/papr_scm: don't requests stats with '0' sized stats buffer

Sachin reported [1] that on a POWER-10 lpar he is seeing a kernel panic being
reported with vPMEM when papr_scm probe is being called. The panic is of the
form below and is observed only with following option disabled(profile) for the
said LPAR 'Enable Performance Information Collection' in the HMC:

Kernel attempted to write user page (1c) - exploit attempt? (uid: 0)
BUG: Kernel NULL pointer dereference on write at 0x0000001c
Faulting instruction address: 0xc008000001b90844
Oops: Kernel access of bad area, sig: 11 [#1]

NIP [c008000001b90844] drc_pmem_query_stats+0x5c/0x270 [papr_scm]
LR [c008000001b92794] papr_scm_probe+0x2ac/0x6ec [papr_scm]
Call Trace:
0xc00000000941bca0 (unreliable)
papr_scm_probe+0x2ac/0x6ec [papr_scm]
platform_probe+0x98/0x150
really_probe+0xfc/0x510
__driver_probe_device+0x17c/0x230

---[ end trace 0000000000000000 ]---
Kernel panic - not syncing: Fatal exception

On investigation looks like this panic was caused due to a 'stat_buffer' of
size==0 being provided to drc_pmem_query_stats() to fetch all performance
stats-ids of an NVDIMM. However drc_pmem_query_stats() shouldn't have been called
since the vPMEM NVDIMM doesn't support and performance stat-id's. This was caused
due to missing check for 'p->stat_buffer_len' at the beginning of
papr_scm_pmu_check_events() which indicates that the NVDIMM doesn't support
performance-stats.

Fix this by introducing the check for 'p->stat_buffer_len' at the beginning of
papr_scm_pmu_check_events().

[1] https://lore.kernel.org/all/[email protected]

Affected

8 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 5.18.5-1 (bookworm)	linux 5.18.5-1 (bookworm)
linux	linux	>= 0e0946e22f3665d27325d389ff45ade6e93f3678 < 07bf9431b1590d1cd7a8d62075d0b50b073f0495	07bf9431b1590d1cd7a8d62075d0b50b073f0495
linux	linux	>= 5.18.3 < 5.18.4	5.18.4
linux	linux	>= b073096df4dec70d0436321b7093bad27ae91f9e < e1295aab2ebcda1c1a9ed342baedc080e5c393e5	e1295aab2ebcda1c1a9ed342baedc080e5c393e5
linux	linux_kernel	—	—
linux	linux_kernel	>= 0 < 5.18.5-1	5.18.5-1
linux	linux_kernel	>= 0 < 5.18.5-1	5.18.5-1
linux	linux_kernel	>= 0 < 5.18.5-1	5.18.5-1

CVSS provenance

nvd v3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

osv 5.5 MEDIUM

vendor_debian 5.5 MEDIUM

vendor_redhat 5.5 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-476