| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <2025022643-CVE-2022-49355-69f7@gregkh> Date: Wed, 26 Feb 2025 03:10:29 +0100 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-cve-announce@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org> Subject: CVE-2022-49355: xen: unexport __init-annotated xen_xlate_map_ballooned_pages() Description =========== In the Linux kernel, the following vulnerability has been resolved: xen: unexport __init-annotated xen_xlate_map_ballooned_pages() EXPORT_SYMBOL and __init is a bad combination because the .init.text section is freed up after the initialization. Hence, modules cannot use symbols annotated __init. The access to a freed symbol may end up with kernel panic. modpost used to detect it, but it has been broken for a decade. Recently, I fixed modpost so it started to warn it again, then this showed up in linux-next builds. There are two ways to fix it: - Remove __init - Remove EXPORT_SYMBOL I chose the latter for this case because none of the in-tree call-sites (arch/arm/xen/enlighten.c, arch/x86/xen/grant-table.c) is compiled as modular. The Linux kernel CVE team has assigned CVE-2022-49355 to this issue. Affected and fixed versions =========================== Issue introduced in 4.8 with commit 243848fc018cb98c2a70c39fe1f93eb266c79835 and fixed in 4.9.321 with commit c0d076419136a7528abc1831847099400f61d60f Issue introduced in 4.8 with commit 243848fc018cb98c2a70c39fe1f93eb266c79835 and fixed in 4.14.286 with commit f319c9b45b351019349cc779ce6721ebc211245c Issue introduced in 4.8 with commit 243848fc018cb98c2a70c39fe1f93eb266c79835 and fixed in 4.19.250 with commit 29a9935a90dd32b89d04e249e0a948cb4949e7af Issue introduced in 4.8 with commit 243848fc018cb98c2a70c39fe1f93eb266c79835 and fixed in 5.4.198 with commit b49c884146e20314808c9420640b26876ff55c80 Issue introduced in 4.8 with commit 243848fc018cb98c2a70c39fe1f93eb266c79835 and fixed in 5.10.122 with commit be9581f4fda795aa0e18cdc333efc1e447e1a55c Issue introduced in 4.8 with commit 243848fc018cb98c2a70c39fe1f93eb266c79835 and fixed in 5.15.47 with commit 40e6078fcf186b4f452abcbffcb004e28d750395 Issue introduced in 4.8 with commit 243848fc018cb98c2a70c39fe1f93eb266c79835 and fixed in 5.17.15 with commit b43387364d8291190fd4ea1322b65c337802baa2 Issue introduced in 4.8 with commit 243848fc018cb98c2a70c39fe1f93eb266c79835 and fixed in 5.18.4 with commit 0ddb4334f4136cd5c84885032894663a4d57928d Issue introduced in 4.8 with commit 243848fc018cb98c2a70c39fe1f93eb266c79835 and fixed in 5.19 with commit dbac14a5a05ff8e1ce7c0da0e1f520ce39ec62ea Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2022-49355 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/xen/xlate_mmu.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/c0d076419136a7528abc1831847099400f61d60f https://git.kernel.org/stable/c/f319c9b45b351019349cc779ce6721ebc211245c https://git.kernel.org/stable/c/29a9935a90dd32b89d04e249e0a948cb4949e7af https://git.kernel.org/stable/c/b49c884146e20314808c9420640b26876ff55c80 https://git.kernel.org/stable/c/be9581f4fda795aa0e18cdc333efc1e447e1a55c https://git.kernel.org/stable/c/40e6078fcf186b4f452abcbffcb004e28d750395 https://git.kernel.org/stable/c/b43387364d8291190fd4ea1322b65c337802baa2 https://git.kernel.org/stable/c/0ddb4334f4136cd5c84885032894663a4d57928d https://git.kernel.org/stable/c/dbac14a5a05ff8e1ce7c0da0e1f520ce39ec62ea
Powered by blists - more mailing lists