linux-cve-announce - CVE-2022-49889: ring-buffer: Check for NULL cpu_buffer in ring_buffer_wake

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025050157-CVE-2022-49889-ff97@gregkh>
Date: Thu,  1 May 2025 16:11:19 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2022-49889: ring-buffer: Check for NULL cpu_buffer in ring_buffer_wake_waiters()

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ring-buffer: Check for NULL cpu_buffer in ring_buffer_wake_waiters()

On some machines the number of listed CPUs may be bigger than the actual
CPUs that exist. The tracing subsystem allocates a per_cpu directory with
access to the per CPU ring buffer via a cpuX file. But to save space, the
ring buffer will only allocate buffers for online CPUs, even though the
CPU array will be as big as the nr_cpu_ids.

With the addition of waking waiters on the ring buffer when closing the
file, the ring_buffer_wake_waiters() now needs to make sure that the
buffer is allocated (with the irq_work allocated with it) before trying to
wake waiters, as it will cause a NULL pointer dereference.

While debugging this, I added a NULL check for the buffer itself (which is
OK to do), and also NULL pointer checks against buffer->buffers (which is
not fine, and will WARN) as well as making sure the CPU number passed in
is within the nr_cpu_ids (which is also not fine if it isn't).

Bugzilla: https://bugzilla.opensuse.org/show_bug.cgi?id=1204705

The Linux kernel CVE team has assigned CVE-2022-49889 to this issue.

Affected and fixed versions
===========================

	Issue introduced in 5.15.75 with commit 2475de2bc0de17fb1b24c5e90194f84b5ca70d3e and fixed in 5.15.78 with commit b5074df412bf3df9d6ce096b6fa03eb1082d05c9
	Issue introduced in 6.0.3 with commit f4f15344110d0b5b8822ac97bc8200e71939c945 and fixed in 6.0.8 with commit 49ca992f6e50d0f46ec9608f44e011cf3121f389
	Issue introduced in 5.19.17 with commit 5544f411a4e8bc39e6a444badbac37dd0e0caf0a

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-49889
will be updated if fixes are backported, please check that for the most
up to date information about this issue.

Affected files
==============

The file(s) affected by this issue are:
	kernel/trace/ring_buffer.c

Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/b5074df412bf3df9d6ce096b6fa03eb1082d05c9
	https://git.kernel.org/stable/c/49ca992f6e50d0f46ec9608f44e011cf3121f389
	https://git.kernel.org/stable/c/7433632c9ff68a991bd0bc38cabf354e9d2de410