CVE-2022-49001 (GCVE-0-2022-49001)

Vulnerability from cvelistv5 – Published: 2024-10-21 20:06 – Updated: 2026-08-05 08:53
VLAI
Title
riscv: fix race when vmap stack overflow
Summary
In the Linux kernel, the following vulnerability has been resolved: riscv: fix race when vmap stack overflow Currently, when detecting vmap stack overflow, riscv firstly switches to the so called shadow stack, then use this shadow stack to call the get_overflow_stack() to get the overflow stack. However, there's a race here if two or more harts use the same shadow stack at the same time. To solve this race, we introduce spin_shadow_stack atomic var, which will be swap between its own address and 0 in atomic way, when the var is set, it means the shadow_stack is being used; when the var is cleared, it means the shadow_stack isn't being used. [Palmer: Add AQ to the swap, and also some comments.]
Severity
7 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-22 13:15 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 31da94c25aea835ceac00575a9fd206c5a833fed , < ac00301adb19df54f2eae1efc4bad7447c0156ce (git)
Affected: 31da94c25aea835ceac00575a9fd206c5a833fed , < 879fabc5a95401d9bce357e4b1d24ae4a360a81f (git)
Affected: 31da94c25aea835ceac00575a9fd206c5a833fed , < 7e1864332fbc1b993659eab7974da9fe8bf8c128 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.14
Unaffected: 0 , < 5.14 (semver)
Unaffected: 5.15.82 , ≤ 5.15.* (semver)
Unaffected: 6.0.12 , ≤ 6.0.* (semver)
Unaffected: 6.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-49001",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-22T13:15:10.722004Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-22T13:18:40.637Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/riscv/include/asm/asm.h",
            "arch/riscv/kernel/entry.S",
            "arch/riscv/kernel/traps.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ac00301adb19df54f2eae1efc4bad7447c0156ce",
              "status": "affected",
              "version": "31da94c25aea835ceac00575a9fd206c5a833fed",
              "versionType": "git"
            },
            {
              "lessThan": "879fabc5a95401d9bce357e4b1d24ae4a360a81f",
              "status": "affected",
              "version": "31da94c25aea835ceac00575a9fd206c5a833fed",
              "versionType": "git"
            },
            {
              "lessThan": "7e1864332fbc1b993659eab7974da9fe8bf8c128",
              "status": "affected",
              "version": "31da94c25aea835ceac00575a9fd206c5a833fed",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/riscv/include/asm/asm.h",
            "arch/riscv/kernel/entry.S",
            "arch/riscv/kernel/traps.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.82",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.82",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.12",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: fix race when vmap stack overflow\n\nCurrently, when detecting vmap stack overflow, riscv firstly switches\nto the so called shadow stack, then use this shadow stack to call the\nget_overflow_stack() to get the overflow stack. However, there\u0027s\na race here if two or more harts use the same shadow stack at the same\ntime.\n\nTo solve this race, we introduce spin_shadow_stack atomic var, which\nwill be swap between its own address and 0 in atomic way, when the\nvar is set, it means the shadow_stack is being used; when the var\nis cleared, it means the shadow_stack isn\u0027t being used.\n\n[Palmer: Add AQ to the swap, and also some comments.]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is RISC-V kernel exception entry (`handle_kernel_stack_overflow` in `entry.S`) when a hart\u2019s kernel stack has already overflowed; it is reached only via local kernel execution on the victim host, not via network protocols or physical buses.\nAC:H - Exploitation requires two or more harts to enter the overflow handler and share the global `shadow_stack` in the same narrow window; inducing simultaneous kernel stack exhaustion is an exceptional error condition with cross-CPU timing the attacker cannot reliably force at will, unlike races built from ordinary attacker-controlled ops.\nPR:L - An unprivileged local user can drive deep kernel call chains (syscalls, nested faults, filesystem recursion) that exhaust a task\u2019s kernel stack on a multi-hart RISC-V system; real root or init-namespace admin rights are not required, and `CONFIG_VMAP_STACK` defaults to y.\nUI:N - No separate victim action (mount, open crafted file, etc.) is required; the attacker\u2019s own workloads on multiple CPUs are sufficient to approach the overflow path.\nS:U - Corruption and panic stay inside the host kernel\u2019s authority (shared shadow stack / overflow handling); this is not a VM escape, IOMMU bypass, or other cross-authority boundary break.\nC:H - Concurrent harts overwrite the shared `shadow_stack` while one may still be executing `get_overflow_stack()` on it, corrupting saved frames and register state (including user-influenced syscall args)\u2014memory corruption that can be leveraged for information disclosure.\nI:H - The same race smashes another hart\u2019s live shadow-stack frame and can load a wrong overflow SP before writing a full `pt_regs`, yielding out-of-bounds kernel writes and potential control-flow hijack via corrupted return/stack state.\nA:H - `handle_bad_stack()` always `panic(\"Kernel stack overflow\")`, and racing on the shared shadow stack can oops or corrupt state before that panic\u2014full kernel availability loss."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:53:23.800Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ac00301adb19df54f2eae1efc4bad7447c0156ce"
        },
        {
          "url": "https://git.kernel.org/stable/c/879fabc5a95401d9bce357e4b1d24ae4a360a81f"
        },
        {
          "url": "https://git.kernel.org/stable/c/7e1864332fbc1b993659eab7974da9fe8bf8c128"
        }
      ],
      "title": "riscv: fix race when vmap stack overflow",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49001",
    "datePublished": "2024-10-21T20:06:15.443Z",
    "dateReserved": "2024-08-22T01:27:53.642Z",
    "dateUpdated": "2026-08-05T08:53:23.800Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49001",
      "date": "2026-09-27",
      "epss": "0.0019",
      "percentile": "0.07737"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "6B49AE96-FD69-40D4-A29C-DC4DB7DE3CDB",
                  "versionEndExcluding": "5.15.82",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "D6D56E90-F3EE-413D-B3E2-B518932F0C7D",
                  "versionEndExcluding": "6.0.12",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*",
                  "matchCriteriaId": "E7E331DA-1FB0-4DEC-91AC-7DA69D461C11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*",
                  "matchCriteriaId": "17F0B248-42CF-4AE6-A469-BB1BAE7F4705",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*",
                  "matchCriteriaId": "E2422816-0C14-4B5E-A1E6-A9D776E5C49B",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*",
                  "matchCriteriaId": "1C6E00FE-5FB9-4D20-A1A1-5A32128F9B76",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc5:*:*:*:*:*:*",
                  "matchCriteriaId": "35B26BE4-43A6-4A36-A7F6-5B3F572D9186",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc6:*:*:*:*:*:*",
                  "matchCriteriaId": "3FFFB0B3-930D-408A-91E2-BAE0C2715D80",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc7:*:*:*:*:*:*",
                  "matchCriteriaId": "8535320E-A0DB-4277-800E-D0CE5BBA59E8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: fix race when vmap stack overflow\n\nCurrently, when detecting vmap stack overflow, riscv firstly switches\nto the so called shadow stack, then use this shadow stack to call the\nget_overflow_stack() to get the overflow stack. However, there\u0027s\na race here if two or more harts use the same shadow stack at the same\ntime.\n\nTo solve this race, we introduce spin_shadow_stack atomic var, which\nwill be swap between its own address and 0 in atomic way, when the\nvar is set, it means the shadow_stack is being used; when the var\nis cleared, it means the shadow_stack isn\u0027t being used.\n\n[Palmer: Add AQ to the swap, and also some comments.]"
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: riscv: arregla la ejecuci\u00f3n cuando se desborda la pila de vmap Actualmente, al detectar un desbordamiento de la pila de vmap, riscv primero cambia a la llamada pila de sombra, luego usa esta pila de sombra para llamar a get_overflow_stack() para obtener la pila de desbordamiento. Sin embargo, aqu\u00ed hay una ejecuci\u00f3n si dos o m\u00e1s harts usan la misma pila de sombra al mismo tiempo. Para resolver esta ejecuci\u00f3n, introducimos la variable at\u00f3mica spin_shadow_stack, que se intercambiar\u00e1 entre su propia direcci\u00f3n y 0 de forma at\u00f3mica, cuando la variable est\u00e1 configurada, significa que se est\u00e1 usando shadow_stack; cuando la variable se borra, significa que no se est\u00e1 usando shadow_stack. [Palmer: Agrega AQ al intercambio y tambi\u00e9n algunos comentarios]."
        }
      ],
      "id": "CVE-2022-49001",
      "lastModified": "2024-10-30T18:58:53.863",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.0,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 1.0,
            "impactScore": 5.9,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2024-10-21T20:15:11.773",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/7e1864332fbc1b993659eab7974da9fe8bf8c128"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/879fabc5a95401d9bce357e4b1d24ae4a360a81f"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/ac00301adb19df54f2eae1efc4bad7447c0156ce"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-362"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "arch/riscv/include/asm/asm.h",
                  "arch/riscv/kernel/entry.S",
                  "arch/riscv/kernel/traps.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "ac00301adb19df54f2eae1efc4bad7447c0156ce",
                    "status": "affected",
                    "version": "31da94c25aea835ceac00575a9fd206c5a833fed",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "879fabc5a95401d9bce357e4b1d24ae4a360a81f",
                    "status": "affected",
                    "version": "31da94c25aea835ceac00575a9fd206c5a833fed",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7e1864332fbc1b993659eab7974da9fe8bf8c128",
                    "status": "affected",
                    "version": "31da94c25aea835ceac00575a9fd206c5a833fed",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "arch/riscv/include/asm/asm.h",
                  "arch/riscv/kernel/entry.S",
                  "arch/riscv/kernel/traps.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.14"
                  },
                  {
                    "lessThan": "5.14",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.82",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.0.*",
                    "status": "unaffected",
                    "version": "6.0.12",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6B49AE96-FD69-40D4-A29C-DC4DB7DE3CDB",
                    "versionEndExcluding": "5.15.82",
                    "versionStartIncluding": "5.14",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D6D56E90-F3EE-413D-B3E2-B518932F0C7D",
                    "versionEndExcluding": "6.0.12",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "E7E331DA-1FB0-4DEC-91AC-7DA69D461C11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "17F0B248-42CF-4AE6-A469-BB1BAE7F4705",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "E2422816-0C14-4B5E-A1E6-A9D776E5C49B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "1C6E00FE-5FB9-4D20-A1A1-5A32128F9B76",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "35B26BE4-43A6-4A36-A7F6-5B3F572D9186",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc6:*:*:*:*:*:*",
                    "matchCriteriaId": "3FFFB0B3-930D-408A-91E2-BAE0C2715D80",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc7:*:*:*:*:*:*",
                    "matchCriteriaId": "8535320E-A0DB-4277-800E-D0CE5BBA59E8",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: fix race when vmap stack overflow\n\nCurrently, when detecting vmap stack overflow, riscv firstly switches\nto the so called shadow stack, then use this shadow stack to call the\nget_overflow_stack() to get the overflow stack. However, there\u0027s\na race here if two or more harts use the same shadow stack at the same\ntime.\n\nTo solve this race, we introduce spin_shadow_stack atomic var, which\nwill be swap between its own address and 0 in atomic way, when the\nvar is set, it means the shadow_stack is being used; when the var\nis cleared, it means the shadow_stack isn\u0027t being used.\n\n[Palmer: Add AQ to the swap, and also some comments.]"
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: riscv: arregla la ejecuci\u00f3n cuando se desborda la pila de vmap Actualmente, al detectar un desbordamiento de la pila de vmap, riscv primero cambia a la llamada pila de sombra, luego usa esta pila de sombra para llamar a get_overflow_stack() para obtener la pila de desbordamiento. Sin embargo, aqu\u00ed hay una ejecuci\u00f3n si dos o m\u00e1s harts usan la misma pila de sombra al mismo tiempo. Para resolver esta ejecuci\u00f3n, introducimos la variable at\u00f3mica spin_shadow_stack, que se intercambiar\u00e1 entre su propia direcci\u00f3n y 0 de forma at\u00f3mica, cuando la variable est\u00e1 configurada, significa que se est\u00e1 usando shadow_stack; cuando la variable se borra, significa que no se est\u00e1 usando shadow_stack. [Palmer: Agrega AQ al intercambio y tambi\u00e9n algunos comentarios]."
          }
        ],
        "id": "CVE-2022-49001",
        "lastModified": "2026-08-04T10:17:30.553",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.0,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.0,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.0,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.0,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2022-49001",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-22T13:15:10.722004Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-10-21T20:15:11.773",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/7e1864332fbc1b993659eab7974da9fe8bf8c128"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/879fabc5a95401d9bce357e4b1d24ae4a360a81f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ac00301adb19df54f2eae1efc4bad7447c0156ce"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-362"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T18:17:38+00:00",
      "cve": "CVE-2022-49001",
      "id": "CVE-2022-49001",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: riscv: fix race when vmap stack overflow",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49001.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T01:35:10Z",
      "cve": "CVE-2022-49001",
      "id": "CVE-2022-49001",
      "initial_release_date": "2024-10-22T14:22:33Z",
      "product_status:known_not_affected": "477",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-49001",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-49001.json",
      "version": "19"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2022-49001",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-10-22T13:15:10.722004Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-10-22T13:15:13.797Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "arch/riscv/include/asm/asm.h",
                "arch/riscv/kernel/entry.S",
                "arch/riscv/kernel/traps.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "ac00301adb19df54f2eae1efc4bad7447c0156ce",
                  "status": "affected",
                  "version": "31da94c25aea835ceac00575a9fd206c5a833fed",
                  "versionType": "git"
                },
                {
                  "lessThan": "879fabc5a95401d9bce357e4b1d24ae4a360a81f",
                  "status": "affected",
                  "version": "31da94c25aea835ceac00575a9fd206c5a833fed",
                  "versionType": "git"
                },
                {
                  "lessThan": "7e1864332fbc1b993659eab7974da9fe8bf8c128",
                  "status": "affected",
                  "version": "31da94c25aea835ceac00575a9fd206c5a833fed",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "arch/riscv/include/asm/asm.h",
                "arch/riscv/kernel/entry.S",
                "arch/riscv/kernel/traps.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "5.14"
                },
                {
                  "lessThan": "5.14",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.82",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.0.*",
                  "status": "unaffected",
                  "version": "6.0.12",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.1",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.82",
                      "versionStartIncluding": "5.14",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.0.12",
                      "versionStartIncluding": "5.14",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1",
                      "versionStartIncluding": "5.14",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: fix race when vmap stack overflow\n\nCurrently, when detecting vmap stack overflow, riscv firstly switches\nto the so called shadow stack, then use this shadow stack to call the\nget_overflow_stack() to get the overflow stack. However, there\u0027s\na race here if two or more harts use the same shadow stack at the same\ntime.\n\nTo solve this race, we introduce spin_shadow_stack atomic var, which\nwill be swap between its own address and 0 in atomic way, when the\nvar is set, it means the shadow_stack is being used; when the var\nis cleared, it means the shadow_stack isn\u0027t being used.\n\n[Palmer: Add AQ to the swap, and also some comments.]"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The vulnerable path is RISC-V kernel exception entry (`handle_kernel_stack_overflow` in `entry.S`) when a hart\u2019s kernel stack has already overflowed; it is reached only via local kernel execution on the victim host, not via network protocols or physical buses.\nAC:H - Exploitation requires two or more harts to enter the overflow handler and share the global `shadow_stack` in the same narrow window; inducing simultaneous kernel stack exhaustion is an exceptional error condition with cross-CPU timing the attacker cannot reliably force at will, unlike races built from ordinary attacker-controlled ops.\nPR:L - An unprivileged local user can drive deep kernel call chains (syscalls, nested faults, filesystem recursion) that exhaust a task\u2019s kernel stack on a multi-hart RISC-V system; real root or init-namespace admin rights are not required, and `CONFIG_VMAP_STACK` defaults to y.\nUI:N - No separate victim action (mount, open crafted file, etc.) is required; the attacker\u2019s own workloads on multiple CPUs are sufficient to approach the overflow path.\nS:U - Corruption and panic stay inside the host kernel\u2019s authority (shared shadow stack / overflow handling); this is not a VM escape, IOMMU bypass, or other cross-authority boundary break.\nC:H - Concurrent harts overwrite the shared `shadow_stack` while one may still be executing `get_overflow_stack()` on it, corrupting saved frames and register state (including user-influenced syscall args)\u2014memory corruption that can be leveraged for information disclosure.\nI:H - The same race smashes another hart\u2019s live shadow-stack frame and can load a wrong overflow SP before writing a full `pt_regs`, yielding out-of-bounds kernel writes and potential control-flow hijack via corrupted return/stack state.\nA:H - `handle_bad_stack()` always `panic(\"Kernel stack overflow\")`, and racing on the shared shadow stack can oops or corrupt state before that panic\u2014full kernel availability loss."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T08:53:23.800Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/ac00301adb19df54f2eae1efc4bad7447c0156ce"
            },
            {
              "url": "https://git.kernel.org/stable/c/879fabc5a95401d9bce357e4b1d24ae4a360a81f"
            },
            {
              "url": "https://git.kernel.org/stable/c/7e1864332fbc1b993659eab7974da9fe8bf8c128"
            }
          ],
          "title": "riscv: fix race when vmap stack overflow",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2022-49001",
        "datePublished": "2024-10-21T20:06:15.443Z",
        "dateReserved": "2024-08-22T01:27:53.642Z",
        "dateUpdated": "2026-08-05T08:53:23.800Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.