« Volver al listado

CVE-2022-49889

Estado: ModificadaMedia (5.5)—

In the Linux kernel, the following vulnerability has been resolved:

ring-buffer: Check for NULL cpu_buffer in ring_buffer_wake_waiters()

On some machines the number of listed CPUs may be bigger than the actual CPUs that exist. The tracing subsystem allocates a per_cpu directory with access to the per CPU ring buffer via a cpuX file. But to save space, the ring buffer will only allocate buffers for online CPUs, even though the CPU array will be as big as the nr_cpu_ids.

With the addition of waking waiters on the ring buffer when closing the file, the ring_buffer_wake_waiters() now needs to make sure that the buffer is allocated (with the irq_work allocated with it) before trying to wake waiters, as it will cause a NULL pointer dereference.

Leer descripción completaMostrar menos

While debugging this, I added a NULL check for the buffer itself (which is OK to do), and also NULL pointer checks against buffer->buffers (which is not fine, and will WARN) as well as making sure the CPU number passed in is within the nr_cpu_ids (which is also not fine if it isn't).

Bugzilla: https://bugzilla.opensuse.org/show_bug.cgi?id=1204705

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Linux — Linux Kernel

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-49889",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-49889",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-10-01T16:09:57.289350Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2475de2bc0de17fb1b24c5e90194f84b5ca70d3e",
              "lessThan": "b5074df412bf3df9d6ce096b6fa03eb1082d05c9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f4f15344110d0b5b8822ac97bc8200e71939c945",
              "lessThan": "49ca992f6e50d0f46ec9608f44e011cf3121f389",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f3ddb74ad0790030c9592229fb14d8c451f4e9a8",
              "lessThan": "7433632c9ff68a991bd0bc38cabf354e9d2de410",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5544f411a4e8bc39e6a444badbac37dd0e0caf0a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5.19.17",
              "lessThan": "5.20",
              "versionType": "semver"
            }
          ],
          "programFiles": [
            "kernel/trace/ring_buffer.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15.75",
              "lessThan": "5.15.78",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "6.0.3",
              "lessThan": "6.0.8",
              "versionType": "semver"
            }
          ],
          "programFiles": [
            "kernel/trace/ring_buffer.c"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-05-01T15:16:13.897",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/49ca992f6e50d0f46ec9608f44e011cf3121f389",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/7433632c9ff68a991bd0bc38cabf354e9d2de410",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b5074df412bf3df9d6ce096b6fa03eb1082d05c9",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-476"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-476"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nring-buffer: Check for NULL cpu_buffer in ring_buffer_wake_waiters()\n\nOn some machines the number of listed CPUs may be bigger than the actual\nCPUs that exist. The tracing subsystem allocates a per_cpu directory with\naccess to the per CPU ring buffer via a cpuX file. But to save space, the\nring buffer will only allocate buffers for online CPUs, even though the\nCPU array will be as big as the nr_cpu_ids.\n\nWith the addition of waking waiters on the ring buffer when closing the\nfile, the ring_buffer_wake_waiters() now needs to make sure that the\nbuffer is allocated (with the irq_work allocated with it) before trying to\nwake waiters, as it will cause a NULL pointer dereference.\n\nWhile debugging this, I added a NULL check for the buffer itself (which is\nOK to do), and also NULL pointer checks against buffer->buffers (which is\nnot fine, and will WARN) as well as making sure the CPU number passed in\nis within the nr_cpu_ids (which is also not fine if it isn't).\n\n\nBugzilla: https://bugzilla.opensuse.org/show_bug.cgi?id=1204705"
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ring-buffer: Comprobar si hay un cpu_buffer nulo en ring_buffer_wake_waiters() En algunas máquinas, el número de CPU listadas puede ser mayor que el de CPU reales existentes. El subsistema de rastreo asigna un directorio per_cpu con acceso al búfer de anillo por CPU a través de un archivo cpuX. Pero para ahorrar espacio, el búfer de anillo solo asignará búferes para las CPU en línea, aunque la matriz de CPU será tan grande como nr_cpu_ids. Con la adición de despertar a los que esperan en el búfer de anillo al cerrar el archivo, ring_buffer_wake_waiters() ahora debe asegurarse de que el búfer esté asignado (con el irq_work asignado con él) antes de intentar despertar a los que esperan, ya que provocará una desreferencia de puntero nulo. Durante la depuración, añadí una comprobación de valores nulos para el propio búfer (lo cual es correcto), así como comprobaciones de punteros nulos contra buffer->buffers (lo cual no es correcto y generará una advertencia), además de asegurarme de que el número de CPU introducido esté dentro del nr_cpu_ids (lo cual tampoco es correcto si no lo está). Bugzilla: https://bugzilla.opensuse.org/show_bug.cgi?id=1204705"
    }
  ],
  "lastModified": "2026-06-17T05:19:25.870",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C4CB2AAA-62E0-462D-A82C-B508C89FE544",
              "versionEndExcluding": "5.15.78",
              "versionStartIncluding": "5.15.75"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6817F83D-0EC4-49B2-AAB2-1836D288AE4E",
              "versionEndExcluding": "6.0",
              "versionStartIncluding": "5.19.17"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4D03DFBA-5776-42FE-83ED-12B26DA723B5",
              "versionEndExcluding": "6.0.8",
              "versionStartIncluding": "6.0.3"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}