CVE-2022-49353: powerpc/papr_scm: don't requests stats with '0' sized stats buffer
In the Linux kernel, the following vulnerability has been resolved:
powerpc/paprscm: don't requests stats with '0' sized stats buffer
Sachin reported [1] that on a POWER-10 lpar he is seeing a kernel panic being reported with vPMEM when paprscm probe is being called. The panic is of the form below and is observed only with following option disabled(profile) for the said LPAR 'Enable Performance Information Collection' in the HMC:
Kernel attempted to write user page (1c) - exploit attempt? (uid: 0) BUG: Kernel NULL pointer dereference on write at 0x0000001c Faulting instruction address: 0xc008000001b90844 Oops: Kernel access of bad area, sig: 11 [#1] <snip> NIP [c008000001b90844] drcpmemquerystats+0x5c/0x270 [paprscm] LR [c008000001b92794] paprscmprobe+0x2ac/0x6ec [paprscm] Call Trace: 0xc00000000941bca0 (unreliable) paprscmprobe+0x2ac/0x6ec [paprscm] platformprobe+0x98/0x150 reallyprobe+0xfc/0x510 driverprobedevice+0x17c/0x230 <snip> ---[ end trace 0000000000000000 ]--- Kernel panic - not syncing: Fatal exception
On investigation looks like this panic was caused due to a 'statbuffer' of size==0 being provided to drcpmemquerystats() to fetch all performance stats-ids of an NVDIMM. However drcpmemquerystats() shouldn't have been called since the vPMEM NVDIMM doesn't support and performance stat-id's. This was caused due to missing check for 'p->statbufferlen' at the beginning of paprscmpmucheckevents() which indicates that the NVDIMM doesn't support performance-stats.
Fix this by introducing the check for 'p->statbufferlen' at the beginning of paprscmpmucheckevents().
[1] https://lore.kernel.org/all/6B3A522A-6A5F-4CC9-B268-0C63AA6E07D3@linux.ibm.com
Other sources
In the Linux kernel, the following vulnerability has been resolved:
powerpc/paprscm: don't requests stats with '0' sized stats buffer
Sachin reported [1] that on a POWER-10 lpar he is seeing a kernel panic being reported with vPMEM when paprscm probe is being called. The panic is of the form below and is observed only with following option disabled(profile) for the said LPAR 'Enable Performance Information Collection' in the HMC:
Kernel attempted to write user page (1c) - exploit attempt? (uid: 0) BUG: Kernel NULL pointer dereference on write at 0x0000001c Faulting instruction address: 0xc008000001b90844 Oops: Kernel access of bad area, sig: 11 [#1] snip NIP [c008000001b90844] drcpmemquerystats+0x5c/0x270 [paprscm] LR [c008000001b92794] paprscmprobe+0x2ac/0x6ec [paprscm] Call Trace: 0xc00000000941bca0 (unreliable) paprscmprobe+0x2ac/0x6ec [paprscm] platformprobe+0x98/0x150 reallyprobe+0xfc/0x510 driverprobedevice+0x17c/0x230 snip ---[ end trace 0000000000000000 ]--- Kernel panic - not syncing: Fatal exception
On investigation looks like this panic was caused due to a 'statbuffer' of size==0 being provided to drcpmemquerystats() to fetch all performance stats-ids of an NVDIMM. However drcpmemquerystats() shouldn't have been called since the vPMEM NVDIMM doesn't support and performance stat-id's. This was caused due to missing check for 'p-statbufferlen' at the beginning of paprscmpmucheckevents() which indicates that the NVDIMM doesn't support performance-stats.
Fix this by introducing the check for 'p-statbufferlen' at the beginning of paprscmpmucheckevents().
[1]
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
On the affected POWER-10 LPAR, disable “Enable Performance Information Collection” so that vPMEM NVDIMMs (which do not support papr_scm performance stat-id’s) do not cause size==0 to be passed into drc_pmem_query_stats().
HMC setting (POWER-10 LPAR) Enable Performance Information Collection = disable
Event History
Frequently Asked Questions
What is the severity of CVE-2022-49353?
The severity of CVE-2022-49353 is medium, with a CVSS score of 5.5.
What type of vulnerability is CVE-2022-49353?
CVE-2022-49353 is classified as a null pointer dereference vulnerability.
How does CVE-2022-49353 manifest in systems?
CVE-2022-49353 may result in a kernel panic when requesting stats with a zero-sized stats buffer in Linux kernel environments.
What systems are affected by CVE-2022-49353?
CVE-2022-49353 affects systems running the Linux kernel with the papr_scm feature enabled.
How can I protect my systems from CVE-2022-49353?
To protect your systems from CVE-2022-49353, ensure your Linux kernel is updated to a version that includes the patch for this vulnerability.