« Volver al listado

CVE-2022-50225

Estado: AnalizadaMedia (5.5)—

In the Linux kernel, the following vulnerability has been resolved:

riscv:uprobe fix SR_SPIE set/clear handling

In riscv the process of uprobe going to clear spie before exec the origin insn,and set spie after that.But When access the page which origin insn has been placed a page fault may happen and irq was disabled in arch_uprobe_pre_xol function,It cause a WARN as follows. There is no need to clear/set spie in arch_uprobe_pre/post/abort_xol. We can just remove it.

Detalles técnicos trazas, registros y código del informe original
[   31.684157] BUG: sleeping function called from invalid context at kernel/locking/rwsem.c:1488
[   31.684677] in_atomic(): 0, irqs_disabled(): 1, non_block: 0, pid: 76, name: work
[   31.684929] preempt_count: 0, expected: 0
[   31.685969] CPU: 2 PID: 76 Comm: work Tainted: G
[   31.686542] Hardware name: riscv-virtio,qemu (DT)
[   31.686797] Call Trace:
[   31.687053] [<ffffffff80006442>] dump_backtrace+0x30/0x38
[   31.687699] [<ffffffff80812118>] show_stack+0x40/0x4c
[   31.688141] [<ffffffff8081817a>] dump_stack_lvl+0x44/0x5c
[   31.688396] [<ffffffff808181aa>] dump_stack+0x18/0x20
[   31.688653] [<ffffffff8003e454>] __might_resched+0x114/0x122
[   31.688948] [<ffffffff8003e4b2>] __might_sleep+0x50/0x7a
[   31.689435] [<ffffffff80822676>] down_read+0x30/0x130
[   31.689728] [<ffffffff8000b650>] do_page_fault+0x166/x446
[   31.689997] [<ffffffff80003c0c>] ret_from_exception+0x0/0xc

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Linux — Linux Kernel

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-50225",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "74784081aac8a0f3636965fc230e2d3b7cc123c6",
              "lessThan": "c71e000db8536d27ec410abb3e314896a78b4f19",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "74784081aac8a0f3636965fc230e2d3b7cc123c6",
              "lessThan": "3811d51778900064d27d8c9a98f73410fb3b471d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "74784081aac8a0f3636965fc230e2d3b7cc123c6",
              "lessThan": "73fc099eaefd9a92c83b6c07dad066411fd5a192",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "74784081aac8a0f3636965fc230e2d3b7cc123c6",
              "lessThan": "3dbe5829408bc1586f75b4667ef60e5aab0209c7",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "arch/riscv/kernel/probes/uprobes.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.12",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.15.61",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "5.18.18",
              "versionType": "semver",
              "lessThanOrEqual": "5.18.*"
            },
            {
              "status": "unaffected",
              "version": "5.19.2",
              "versionType": "semver",
              "lessThanOrEqual": "5.19.*"
            },
            {
              "status": "unaffected",
              "version": "6.0",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "arch/riscv/kernel/probes/uprobes.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-06-18T11:15:53.517",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/3811d51778900064d27d8c9a98f73410fb3b471d",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/3dbe5829408bc1586f75b4667ef60e5aab0209c7",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/73fc099eaefd9a92c83b6c07dad066411fd5a192",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c71e000db8536d27ec410abb3e314896a78b4f19",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-667"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv:uprobe fix SR_SPIE set/clear handling\n\nIn riscv the process of uprobe going to clear spie before exec\nthe origin insn,and set spie after that.But When access the page\nwhich origin insn has been placed a page fault may happen and\nirq was disabled in arch_uprobe_pre_xol function,It cause a WARN\nas follows.\nThere is no need to clear/set spie in arch_uprobe_pre/post/abort_xol.\nWe can just remove it.\n\n[   31.684157] BUG: sleeping function called from invalid context at kernel/locking/rwsem.c:1488\n[   31.684677] in_atomic(): 0, irqs_disabled(): 1, non_block: 0, pid: 76, name: work\n[   31.684929] preempt_count: 0, expected: 0\n[   31.685969] CPU: 2 PID: 76 Comm: work Tainted: G\n[   31.686542] Hardware name: riscv-virtio,qemu (DT)\n[   31.686797] Call Trace:\n[   31.687053] [<ffffffff80006442>] dump_backtrace+0x30/0x38\n[   31.687699] [<ffffffff80812118>] show_stack+0x40/0x4c\n[   31.688141] [<ffffffff8081817a>] dump_stack_lvl+0x44/0x5c\n[   31.688396] [<ffffffff808181aa>] dump_stack+0x18/0x20\n[   31.688653] [<ffffffff8003e454>] __might_resched+0x114/0x122\n[   31.688948] [<ffffffff8003e4b2>] __might_sleep+0x50/0x7a\n[   31.689435] [<ffffffff80822676>] down_read+0x30/0x130\n[   31.689728] [<ffffffff8000b650>] do_page_fault+0x166/x446\n[   31.689997] [<ffffffff80003c0c>] ret_from_exception+0x0/0xc"
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: riscv:uprobe fix SR_SPIE set/clear management. En riscv, el proceso de uprobe borra spie antes de ejecutar la instrucción de origen y la configura después. Sin embargo, al acceder a la página donde se ha colocado la instrucción de origen, puede producirse un fallo de página y la función irq se ha deshabilitado en arch_uprobe_pre_xol. Esto genera una advertencia como la siguiente. No es necesario borrar/configurar spie en arch_uprobe_pre/post/abort_xol. Simplemente podemos eliminarlo. [ 31.684157] ERROR: función de suspensión llamada desde un contexto no válido en kernel/locking/rwsem.c:1488 [ 31.684677] in_atomic(): 0, irqs_disabled(): 1, non_block: 0, pid: 76, name: work [ 31.684929] preempt_count: 0, expected: 0 [ 31.685969] CPU: 2 PID: 76 Comm: work Tainted: G [ 31.686542] Nombre del hardware: riscv-virtio,qemu (DT) [ 31.686797] Rastreo de llamadas: [ 31.687053] [] dump_backtrace+0x30/0x38 [ 31.687699] [] show_stack+0x40/0x4c [ 31.688141] [] dump_stack_lvl+0x44/0x5c [ 31.688396] [] dump_stack+0x18/0x20 [ 31.688653] [] __might_resched+0x114/0x122 [ 31.688948] [] __might_sleep+0x50/0x7a [ 31.689435] [] down_read+0x30/0x130 [ 31.689728] [] do_page_fault+0x166/x446 [ 31.689997] [] ret_from_exception+0x0/0xc "
    }
  ],
  "lastModified": "2026-06-17T05:23:01.040",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "23E86361-3C85-4727-87EC-1E6ACE028490",
              "versionEndExcluding": "5.15.61",
              "versionStartIncluding": "5.12"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5B42E453-8837-49D0-A5EF-03F818A6DC11",
              "versionEndExcluding": "5.18.18",
              "versionStartIncluding": "5.16"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A1A2A5A5-4598-4D7E-BA07-4660398D6C8F",
              "versionEndExcluding": "5.19.2",
              "versionStartIncluding": "5.19"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}