CVE-2022-49394

published 2025-02-26

CVE-2022-49394: In the Linux kernel, the following vulnerability has been resolved: blk-iolatency: Fix inflight count imbalances and IO hangs on offline iolatency needs to…

Priority P4 21 medium 5.5 CVSS 3.1

AV L AC L PR L UI N S U C N I N A H

In the Linux kernel, the following vulnerability has been resolved:

blk-iolatency: Fix inflight count imbalances and IO hangs on offline

iolatency needs to track the number of inflight IOs per cgroup. As this
tracking can be expensive, it is disabled when no cgroup has iolatency
configured for the device. To ensure that the inflight counters stay
balanced, iolatency_set_limit() freezes the request_queue while manipulating
the enabled counter, which ensures that no IO is in flight and thus all
counters are zero.

Unfortunately, iolatency_set_limit() isn't the only place where the enabled
counter is manipulated. iolatency_pd_offline() can also dec the counter and
trigger disabling. As this disabling happens without freezing the q, this
can easily happen while some IOs are in flight and thus leak the counts.

This can be easily demonstrated by turning on iolatency on an one empty
cgroup while IOs are in flight in other cgroups and then removing the
cgroup. Note that iolatency shouldn't have been enabled elsewhere in the
system to ensure that removing the cgroup disables iolatency for the whole
device.

The following keeps flipping on and off iolatency on sda:

echo +io > /sys/fs/cgroup/cgroup.subtree_control
while true; do
mkdir -p /sys/fs/cgroup/test
echo '8:0 target=100000' > /sys/fs/cgroup/test/io.latency
sleep 1
rmdir /sys/fs/cgroup/test
sleep 1
done

and there's concurrent fio generating direct rand reads:

fio --name test --filename=/dev/sda --direct=1 --rw=randread \
--runtime=600 --time_based --iodepth=256 --numjobs=4 --bs=4k

while monitoring with the following drgn script:

while True:
for css in css_for_each_descendant_pre(prog['blkcg_root'].css.address_of_()):
for pos in hlist_for_each(container_of(css, 'struct blkcg', 'css').blkg_list):
blkg = container_of(pos, 'struct blkcg_gq', 'blkcg_node')
pd = blkg.pd[prog['blkcg_policy_iolatency'].plid]
if pd.value_() == 0:
continue
iolat = container_of(pd, 'struct iolatency_grp', 'pd')
inflight = iolat.rq_wait.inf

Affected

24 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 5.18.5-1 (bookworm)	linux 5.18.5-1 (bookworm)
linux	linux	—	—
linux	linux	—	—
linux	linux	>= 4.19.29 < 4.19.247	4.19.247
linux	linux	>= 4.20.16 < 4.21	4.21
linux	linux	>= 6d482bc5697763eb1214f207286daa201b32d20a < 515d077ee3085ae343b6bea7fd031f9906645f38	515d077ee3085ae343b6bea7fd031f9906645f38
linux	linux	>= 8c772a9bfc7c07c76f4a58b58910452fbb20843b < d19fa8f252000d141f9199ca32959c50314e1f05	d19fa8f252000d141f9199ca32959c50314e1f05
linux	linux	>= 8c772a9bfc7c07c76f4a58b58910452fbb20843b < 77692c02e1517c54f2fd0535f41aa4286ac9f140	77692c02e1517c54f2fd0535f41aa4286ac9f140
linux	linux	>= 8c772a9bfc7c07c76f4a58b58910452fbb20843b < a30acbb5dfb7bcc813ad6a18ca31011ac44e5547	a30acbb5dfb7bcc813ad6a18ca31011ac44e5547
linux	linux	>= 8c772a9bfc7c07c76f4a58b58910452fbb20843b < 968f7a239c590454ffba79c126fbe0e963a0ba78	968f7a239c590454ffba79c126fbe0e963a0ba78
linux	linux	>= 8c772a9bfc7c07c76f4a58b58910452fbb20843b < 5b0ff3ebbef791341695b718f8d2870869cf1d01	5b0ff3ebbef791341695b718f8d2870869cf1d01
linux	linux	>= 8c772a9bfc7c07c76f4a58b58910452fbb20843b < 8a177a36da6c54c98b8685d4f914cb3637d53c0d	8a177a36da6c54c98b8685d4f914cb3637d53c0d
linux	linux_kernel	—	—
linux	linux_kernel	>= 0 < 5.10.127-1	5.10.127-1
linux	linux_kernel	>= 0 < 5.18.5-1	5.18.5-1
linux	linux_kernel	>= 0 < 5.18.5-1	5.18.5-1
linux	linux_kernel	>= 0 < 5.18.5-1	5.18.5-1
linux	linux_kernel	>= 4.19.29 < 4.19.247	4.19.247
linux	linux_kernel	>= 4.20.16 < 5.0	5.0
linux	linux_kernel	>= 5.0.1 < 5.4.198	5.4.198
linux	linux_kernel	>= 5.11 < 5.15.46	5.15.46
linux	linux_kernel	>= 5.16 < 5.17.14	5.17.14
linux	linux_kernel	>= 5.18 < 5.18.3	5.18.3
linux	linux_kernel	>= 5.5 < 5.10.121	5.10.121

CVSS provenance

nvd v3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

osv 5.5 MEDIUM

vendor_debian 5.5 MEDIUM

vendor_redhat 5.5 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-99