cve-2022-49004
Vulnerability from cvelistv5
Published
2024-10-21 20:06
Modified
2025-05-04 08:27
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: riscv: Sync efi page table's kernel mappings before switching The EFI page table is initially created as a copy of the kernel page table. With VMAP_STACK enabled, kernel stacks are allocated in the vmalloc area: if the stack is allocated in a new PGD (one that was not present at the moment of the efi page table creation or not synced in a previous vmalloc fault), the kernel will take a trap when switching to the efi page table when the vmalloc kernel stack is accessed, resulting in a kernel panic. Fix that by updating the efi kernel mappings before switching to the efi page table.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/3f105a742725a1b78766a55169f1d827732e62b8Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/96f479383d92944406d4b3f2bc03c2f640def9f1Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/fa7a7d185ef380546b4b1fed6f84f31dbae8cec7Patch
Impacted products
Vendor Product Version
Linux Linux Version: b91540d52a08b65eb6a2b09132e1bd54fa82754c
Version: b91540d52a08b65eb6a2b09132e1bd54fa82754c
Version: b91540d52a08b65eb6a2b09132e1bd54fa82754c
 Create a notification for this product.
   Linux Linux Version: 5.10
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-49004",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-10-22T13:14:45.523737Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-10-22T13:18:40.145Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "Linux",
               programFiles: [
                  "arch/riscv/include/asm/efi.h",
                  "arch/riscv/include/asm/pgalloc.h",
               ],
               repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               vendor: "Linux",
               versions: [
                  {
                     lessThan: "fa7a7d185ef380546b4b1fed6f84f31dbae8cec7",
                     status: "affected",
                     version: "b91540d52a08b65eb6a2b09132e1bd54fa82754c",
                     versionType: "git",
                  },
                  {
                     lessThan: "96f479383d92944406d4b3f2bc03c2f640def9f1",
                     status: "affected",
                     version: "b91540d52a08b65eb6a2b09132e1bd54fa82754c",
                     versionType: "git",
                  },
                  {
                     lessThan: "3f105a742725a1b78766a55169f1d827732e62b8",
                     status: "affected",
                     version: "b91540d52a08b65eb6a2b09132e1bd54fa82754c",
                     versionType: "git",
                  },
               ],
            },
            {
               defaultStatus: "affected",
               product: "Linux",
               programFiles: [
                  "arch/riscv/include/asm/efi.h",
                  "arch/riscv/include/asm/pgalloc.h",
               ],
               repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               vendor: "Linux",
               versions: [
                  {
                     status: "affected",
                     version: "5.10",
                  },
                  {
                     lessThan: "5.10",
                     status: "unaffected",
                     version: "0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "5.15.*",
                     status: "unaffected",
                     version: "5.15.82",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "6.0.*",
                     status: "unaffected",
                     version: "6.0.12",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "*",
                     status: "unaffected",
                     version: "6.1",
                     versionType: "original_commit_for_fix",
                  },
               ],
            },
         ],
         cpeApplicability: [
            {
               nodes: [
                  {
                     cpeMatch: [
                        {
                           criteria: "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                           versionEndExcluding: "5.15.82",
                           versionStartIncluding: "5.10",
                           vulnerable: true,
                        },
                        {
                           criteria: "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                           versionEndExcluding: "6.0.12",
                           versionStartIncluding: "5.10",
                           vulnerable: true,
                        },
                        {
                           criteria: "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                           versionEndExcluding: "6.1",
                           versionStartIncluding: "5.10",
                           vulnerable: true,
                        },
                     ],
                     negate: false,
                     operator: "OR",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: Sync efi page table's kernel mappings before switching\n\nThe EFI page table is initially created as a copy of the kernel page table.\nWith VMAP_STACK enabled, kernel stacks are allocated in the vmalloc area:\nif the stack is allocated in a new PGD (one that was not present at the\nmoment of the efi page table creation or not synced in a previous vmalloc\nfault), the kernel will take a trap when switching to the efi page table\nwhen the vmalloc kernel stack is accessed, resulting in a kernel panic.\n\nFix that by updating the efi kernel mappings before switching to the efi\npage table.",
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-05-04T08:27:52.326Z",
            orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            shortName: "Linux",
         },
         references: [
            {
               url: "https://git.kernel.org/stable/c/fa7a7d185ef380546b4b1fed6f84f31dbae8cec7",
            },
            {
               url: "https://git.kernel.org/stable/c/96f479383d92944406d4b3f2bc03c2f640def9f1",
            },
            {
               url: "https://git.kernel.org/stable/c/3f105a742725a1b78766a55169f1d827732e62b8",
            },
         ],
         title: "riscv: Sync efi page table's kernel mappings before switching",
         x_generator: {
            engine: "bippy-1.2.0",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      assignerShortName: "Linux",
      cveId: "CVE-2022-49004",
      datePublished: "2024-10-21T20:06:17.410Z",
      dateReserved: "2024-08-22T01:27:53.643Z",
      dateUpdated: "2025-05-04T08:27:52.326Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      nvd: "{\"cve\":{\"id\":\"CVE-2022-49004\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-10-21T20:15:11.990\",\"lastModified\":\"2024-10-25T14:21:21.593\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nriscv: Sync efi page table's kernel mappings before switching\\n\\nThe EFI page table is initially created as a copy of the kernel page table.\\nWith VMAP_STACK enabled, kernel stacks are allocated in the vmalloc area:\\nif the stack is allocated in a new PGD (one that was not present at the\\nmoment of the efi page table creation or not synced in a previous vmalloc\\nfault), the kernel will take a trap when switching to the efi page table\\nwhen the vmalloc kernel stack is accessed, resulting in a kernel panic.\\n\\nFix that by updating the efi kernel mappings before switching to the efi\\npage table.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: riscv: Sincronizar las asignaciones de kernel de la tabla de páginas efi antes de cambiar La tabla de páginas efi se crea inicialmente como una copia de la tabla de páginas del kernel. Con VMAP_STACK habilitado, las pilas del kernel se asignan en el área vmalloc: si la pila se asigna en un nuevo PGD (uno que no estaba presente en el momento de la creación de la tabla de páginas efi o no se sincronizó en un error vmalloc anterior), el kernel tomará una trampa al cambiar a la tabla de páginas efi cuando se accede a la pila del kernel vmalloc, lo que resulta en un pánico del kernel. Solucione eso actualizando las asignaciones de kernel efi antes de cambiar a la tabla de páginas efi.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.10\",\"versionEndExcluding\":\"5.15.82\",\"matchCriteriaId\":\"F4165171-EE33-4D81-A676-357C0DDDA2D4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.0.12\",\"matchCriteriaId\":\"D6D56E90-F3EE-413D-B3E2-B518932F0C7D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"E7E331DA-1FB0-4DEC-91AC-7DA69D461C11\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"17F0B248-42CF-4AE6-A469-BB1BAE7F4705\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"E2422816-0C14-4B5E-A1E6-A9D776E5C49B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"1C6E00FE-5FB9-4D20-A1A1-5A32128F9B76\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"35B26BE4-43A6-4A36-A7F6-5B3F572D9186\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"3FFFB0B3-930D-408A-91E2-BAE0C2715D80\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"8535320E-A0DB-4277-800E-D0CE5BBA59E8\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3f105a742725a1b78766a55169f1d827732e62b8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/96f479383d92944406d4b3f2bc03c2f640def9f1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fa7a7d185ef380546b4b1fed6f84f31dbae8cec7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
      vulnrichment: {
         containers: "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-49004\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-22T13:14:45.523737Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-22T13:14:48.980Z\"}}], \"cna\": {\"title\": \"riscv: Sync efi page table's kernel mappings before switching\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"b91540d52a08b65eb6a2b09132e1bd54fa82754c\", \"lessThan\": \"fa7a7d185ef380546b4b1fed6f84f31dbae8cec7\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b91540d52a08b65eb6a2b09132e1bd54fa82754c\", \"lessThan\": \"96f479383d92944406d4b3f2bc03c2f640def9f1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b91540d52a08b65eb6a2b09132e1bd54fa82754c\", \"lessThan\": \"3f105a742725a1b78766a55169f1d827732e62b8\", \"versionType\": \"git\"}], \"programFiles\": [\"arch/riscv/include/asm/efi.h\", \"arch/riscv/include/asm/pgalloc.h\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.10\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.10\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.82\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.0.12\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.0.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"arch/riscv/include/asm/efi.h\", \"arch/riscv/include/asm/pgalloc.h\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/fa7a7d185ef380546b4b1fed6f84f31dbae8cec7\"}, {\"url\": \"https://git.kernel.org/stable/c/96f479383d92944406d4b3f2bc03c2f640def9f1\"}, {\"url\": \"https://git.kernel.org/stable/c/3f105a742725a1b78766a55169f1d827732e62b8\"}], \"x_generator\": {\"engine\": \"bippy-5f407fcff5a0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nriscv: Sync efi page table's kernel mappings before switching\\n\\nThe EFI page table is initially created as a copy of the kernel page table.\\nWith VMAP_STACK enabled, kernel stacks are allocated in the vmalloc area:\\nif the stack is allocated in a new PGD (one that was not present at the\\nmoment of the efi page table creation or not synced in a previous vmalloc\\nfault), the kernel will take a trap when switching to the efi page table\\nwhen the vmalloc kernel stack is accessed, resulting in a kernel panic.\\n\\nFix that by updating the efi kernel mappings before switching to the efi\\npage table.\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-12-19T08:12:16.402Z\"}}}",
         cveMetadata: "{\"cveId\": \"CVE-2022-49004\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-12-19T08:12:16.402Z\", \"dateReserved\": \"2024-08-22T01:27:53.643Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T20:06:17.410Z\", \"assignerShortName\": \"Linux\"}",
         dataType: "CVE_RECORD",
         dataVersion: "5.1",
      },
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.