CVE-2022-49647
published 2025-02-26CVE-2022-49647: In the Linux kernel, the following vulnerability has been resolved: cgroup: Use separate src/dst nodes when preloading css_sets for migration Each cset…
PriorityP339high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.29%
21.2th percentile
In the Linux kernel, the following vulnerability has been resolved:
cgroup: Use separate src/dst nodes when preloading css_sets for migration
Each cset (css_set) is pinned by its tasks. When we're moving tasks around
across csets for a migration, we need to hold the source and destination
csets to ensure that they don't go away while we're moving tasks about. This
is done by linking cset->mg_preload_node on either the
mgctx->preloaded_src_csets or mgctx->preloaded_dst_csets list. Using the
same cset->mg_preload_node for both the src and dst lists was deemed okay as
a cset can't be both the source and destination at the same time.
Unfortunately, this overloading becomes problematic when multiple tasks are
involved in a migration and some of them are identity noop migrations while
others are actually moving across cgroups. For example, this can happen with
the following sequence on cgroup1:
#1> mkdir -p /sys/fs/cgroup/misc/a/b
#2> echo $$ > /sys/fs/cgroup/misc/a/cgroup.procs
#3> RUN_A_COMMAND_WHICH_CREATES_MULTIPLE_THREADS &
#4> PID=$!
#5> echo $PID > /sys/fs/cgroup/misc/a/b/tasks
#6> echo $PID > /sys/fs/cgroup/misc/a/cgroup.procs
the process including the group leader back into a. In this final migration,
non-leader threads would be doing identity migration while the group leader
is doing an actual one.
After #3, let's say the whole process was in cset A, and that after #4, the
leader moves to cset B. Then, during #6, the following happens:
1. cgroup_migrate_add_src() is called on B for the leader.
2. cgroup_migrate_add_src() is called on A for the other threads.
3. cgroup_migrate_prepare_dst() is called. It scans the src list.
4. It notices that B wants to migrate to A, so it tries to A to the dst
list but realizes that its ->mg_preload_node is already busy.
5. and then it notices A wants to migrate to A as it's an identity
migration, it culls it by list_del_init()'ing its ->mg_preload_node and
putting references accordingly.
6. The rest of migration tak
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.18.14-1 (bookworm) | linux 5.18.14-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= f817de98513d060023be4fa1d061b29a6515273e < 05f7658210d1d331e8dd4cb6e7bbbe3df5f5ac27 | 05f7658210d1d331e8dd4cb6e7bbbe3df5f5ac27 |
| linux | linux | >= f817de98513d060023be4fa1d061b29a6515273e < cec2bbdcc14fbaa6b95ee15a7c423b05d97038be | cec2bbdcc14fbaa6b95ee15a7c423b05d97038be |
| linux | linux | >= f817de98513d060023be4fa1d061b29a6515273e < ad44e05f3e016bdcb1ad25af35ade5b5f41ccd68 | ad44e05f3e016bdcb1ad25af35ade5b5f41ccd68 |
| linux | linux | >= f817de98513d060023be4fa1d061b29a6515273e < 7657e3958535d101a24ab4400f9b8062b9107cc4 | 7657e3958535d101a24ab4400f9b8062b9107cc4 |
| linux | linux | >= f817de98513d060023be4fa1d061b29a6515273e < 54aee4e5ce8c21555286a6333e46c1713880cf93 | 54aee4e5ce8c21555286a6333e46c1713880cf93 |
| linux | linux | >= f817de98513d060023be4fa1d061b29a6515273e < 0e41774b564befa6d271e8d5086bf870d617a4e6 | 0e41774b564befa6d271e8d5086bf870d617a4e6 |
| linux | linux | >= f817de98513d060023be4fa1d061b29a6515273e < 07fd5b6cdf3cc30bfde8fe0f644771688be04447 | 07fd5b6cdf3cc30bfde8fe0f644771688be04447 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.136-1 | 5.10.136-1 |
| linux | linux_kernel | >= 0 < 5.18.14-1 | 5.18.14-1 |
| linux | linux_kernel | >= 0 < 5.18.14-1 | 5.18.14-1 |
| linux | linux_kernel | >= 0 < 5.18.14-1 | 5.18.14-1 |
| linux | linux_kernel | >= 3.16 < 4.14.289 | 4.14.289 |
| linux | linux_kernel | >= 4.15 < 4.19.253 | 4.19.253 |
| linux | linux_kernel | >= 4.20 < 5.4.207 | 5.4.207 |
| linux | linux_kernel | >= 5.11 < 5.15.56 | 5.15.56 |
| linux | linux_kernel | >= 5.16 < 5.18.13 | 5.18.13 |
| linux | linux_kernel | >= 5.5 < 5.10.132 | 5.10.132 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-x3qg-8v4m-cfv7: In the Linux kernel, the following vulnerability has been resolved:
cgroup: Use separate src/dst nodes when preloading css_sets for migration
Each c
ghsa_unreviewed·2025-02-27
CVE-2022-49647 [HIGH] CWE-416 GHSA-x3qg-8v4m-cfv7: In the Linux kernel, the following vulnerability has been resolved:
cgroup: Use separate src/dst nodes when preloading css_sets for migration
Each c
In the Linux kernel, the following vulnerability has been resolved:
cgroup: Use separate src/dst nodes when preloading css_sets for migration
Each cset (css_set) is pinned by its tasks. When we're moving tasks around
across csets for a migration, we need to hold the source and destination
csets to ensure that they don't go away while we're moving tasks about. This
is done by linking cset->mg_preload_node on either the
mgctx->preloaded_src_csets or mgctx->preloaded_dst_csets list. Using the
same cset->mg_preload_node for both the src and dst lists was deemed okay as
a cset can't be both the source and destination at the same time.
Unfortunately, this overloading becomes problematic when multiple tasks are
involved in a migration and some of them are identity noop migrations while
others
OSV
CVE-2022-49647: In the Linux kernel, the following vulnerability has been resolved: cgroup: Use separate src/dst nodes when preloading css_sets for migration Each cse
osv·2025-02-26·CVSS 7.8
CVE-2022-49647 [HIGH] CVE-2022-49647: In the Linux kernel, the following vulnerability has been resolved: cgroup: Use separate src/dst nodes when preloading css_sets for migration Each cse
In the Linux kernel, the following vulnerability has been resolved: cgroup: Use separate src/dst nodes when preloading css_sets for migration Each cset (css_set) is pinned by its tasks. When we're moving tasks around across csets for a migration, we need to hold the source and destination csets to ensure that they don't go away while we're moving tasks about. This is done by linking cset->mg_preload_node on either the mgctx->preloaded_src_csets or mgctx->preloaded_dst_csets list. Using the same cset->mg_preload_node for both the src and dst lists was deemed okay as a cset can't be both the source and destination at the same time. Unfortunately, this overloading becomes problematic when multiple tasks are involved in a migration and some of them are identity noop migrations while others are
Red Hat
kernel: cgroup: Use separate src/dst nodes when preloading css_sets for migration
vendor_redhat·2025-02-26·CVSS 7.8
CVE-2022-49647 [HIGH] kernel: cgroup: Use separate src/dst nodes when preloading css_sets for migration
kernel: cgroup: Use separate src/dst nodes when preloading css_sets for migration
In the Linux kernel, the following vulnerability has been resolved:
cgroup: Use separate src/dst nodes when preloading css_sets for migration
Each cset (css_set) is pinned by its tasks. When we're moving tasks around
across csets for a migration, we need to hold the source and destination
csets to ensure that they don't go away while we're moving tasks about. This
is done by linking cset->mg_preload_node on either the
mgctx->preloaded_src_csets or mgctx->preloaded_dst_csets list. Using the
same cset->mg_preload_node for both the src and dst lists was deemed okay as
a cset can't be both the source and destination at the same time.
Unfortunately, this overloading becomes problematic when multiple tasks are
inv
Debian
CVE-2022-49647: linux - In the Linux kernel, the following vulnerability has been resolved: cgroup: Use...
vendor_debian·2022·CVSS 7.8
CVE-2022-49647 [HIGH] CVE-2022-49647: linux - In the Linux kernel, the following vulnerability has been resolved: cgroup: Use...
In the Linux kernel, the following vulnerability has been resolved: cgroup: Use separate src/dst nodes when preloading css_sets for migration Each cset (css_set) is pinned by its tasks. When we're moving tasks around across csets for a migration, we need to hold the source and destination csets to ensure that they don't go away while we're moving tasks about. This is done by linking cset->mg_preload_node on either the mgctx->preloaded_src_csets or mgctx->preloaded_dst_csets list. Using the same cset->mg_preload_node for both the src and dst lists was deemed okay as a cset can't be both the source and destination at the same time. Unfortunately, this overloading becomes problematic when multiple tasks are involved in a migration and some of them are identity noop migrations while others are
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/05f7658210d1d331e8dd4cb6e7bbbe3df5f5ac27https://git.kernel.org/stable/c/07fd5b6cdf3cc30bfde8fe0f644771688be04447https://git.kernel.org/stable/c/0e41774b564befa6d271e8d5086bf870d617a4e6https://git.kernel.org/stable/c/54aee4e5ce8c21555286a6333e46c1713880cf93https://git.kernel.org/stable/c/7657e3958535d101a24ab4400f9b8062b9107cc4https://git.kernel.org/stable/c/ad44e05f3e016bdcb1ad25af35ade5b5f41ccd68https://git.kernel.org/stable/c/cec2bbdcc14fbaa6b95ee15a7c423b05d97038be
2025-02-26
Published