CVE-2022-49520

published 2025-02-26

CVE-2022-49520: In the Linux kernel, the following vulnerability has been resolved: arm64: compat: Do not treat syscall number as ESR_ELx for a bad syscall If a compat process…

Priority P4 20 medium 5.5 CVSS 3.1

AV L AC L PR L UI N S U C N I N A H

In the Linux kernel, the following vulnerability has been resolved:

arm64: compat: Do not treat syscall number as ESR_ELx for a bad syscall

If a compat process tries to execute an unknown system call above the
__ARM_NR_COMPAT_END number, the kernel sends a SIGILL signal to the
offending process. Information about the error is printed to dmesg in
compat_arm_syscall() -> arm64_notify_die() -> arm64_force_sig_fault() ->
arm64_show_signal().

arm64_show_signal() interprets a non-zero value for
current->thread.fault_code as an exception syndrome and displays the
message associated with the ESR_ELx.EC field (bits 31:26).
current->thread.fault_code is set in compat_arm_syscall() ->
arm64_notify_die() with the bad syscall number instead of a valid ESR_ELx
value. This means that the ESR_ELx.EC field has the value that the user set
for the syscall number and the kernel can end up printing bogus exception
messages*. For example, for the syscall number 0x68000000, which evaluates
to ESR_ELx.EC value of 0x1A (ESR_ELx_EC_FPAC) the kernel prints this error:

[ 18.349161] syscall[300]: unhandled exception: ERET/ERETAA/ERETAB, ESR 0x68000000, Oops - bad compat syscall(2) in syscall[10000+50000]
[ 18.350639] CPU: 2 PID: 300 Comm: syscall Not tainted 5.18.0-rc1 #79
[ 18.351249] Hardware name: Pine64 RockPro64 v2.0 (DT)
[..]

which is misleading, as the bad compat syscall has nothing to do with
pointer authentication.

Stop arm64_show_signal() from printing exception syndrome information by
having compat_arm_syscall() set the ESR_ELx value to 0, as it has no
meaning for an invalid system call number. The example above now becomes:

[ 19.935275] syscall[301]: unhandled exception: Oops - bad compat syscall(2) in syscall[10000+50000]
[ 19.936124] CPU: 1 PID: 301 Comm: syscall Not tainted 5.18.0-rc1-00005-g7e08006d4102 #80
[ 19.936894] Hardware name: Pine64 RockPro64 v2.0 (DT)
[..]

which although shows less information because the syscall number,
wrongfully advertised as the ESR value,

Affected

17 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 5.18.5-1 (bookworm)	linux 5.18.5-1 (bookworm)
linux	linux	—	—
linux	linux	>= 0be7320a635c2e434e8b67e0e9474a85ceb421c4 < efd183d988b416fcdf6f7c298a17ced4859ca77d	efd183d988b416fcdf6f7c298a17ced4859ca77d
linux	linux	>= 0be7320a635c2e434e8b67e0e9474a85ceb421c4 < ad97425d23af3c3b8d4f6a2bb666cb485087c007	ad97425d23af3c3b8d4f6a2bb666cb485087c007
linux	linux	>= 0be7320a635c2e434e8b67e0e9474a85ceb421c4 < 621916afe8cd4f322eb12759b64a2f938d4e551d	621916afe8cd4f322eb12759b64a2f938d4e551d
linux	linux	>= 0be7320a635c2e434e8b67e0e9474a85ceb421c4 < 095e975f8150ccd7f852eb578c1cdbdd2f517c7a	095e975f8150ccd7f852eb578c1cdbdd2f517c7a
linux	linux	>= 0be7320a635c2e434e8b67e0e9474a85ceb421c4 < 3910ae71cb963fa2b68e684489d4fc3d105afda0	3910ae71cb963fa2b68e684489d4fc3d105afda0
linux	linux	>= 0be7320a635c2e434e8b67e0e9474a85ceb421c4 < 3fed9e551417b84038b15117732ea4505eee386b	3fed9e551417b84038b15117732ea4505eee386b
linux	linux_kernel	< 5.4.198	5.4.198
linux	linux_kernel	>= 0 < 5.10.127-1	5.10.127-1
linux	linux_kernel	>= 0 < 5.18.5-1	5.18.5-1
linux	linux_kernel	>= 0 < 5.18.5-1	5.18.5-1
linux	linux_kernel	>= 0 < 5.18.5-1	5.18.5-1
linux	linux_kernel	>= 5.11 < 5.15.46	5.15.46
linux	linux_kernel	>= 5.16 < 5.17.14	5.17.14
linux	linux_kernel	>= 5.18 < 5.18.3	5.18.3
linux	linux_kernel	>= 5.5 < 5.10.121	5.10.121

CVSS provenance

nvd v3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

osv 5.5 MEDIUM

vendor_debian 5.5 MEDIUM

vendor_redhat 5.5 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.