CVE-2022-49781 (GCVE-0-2022-49781)
Vulnerability from cvelistv5
Published
2025-05-01 14:09
Modified
2025-05-04 08:45
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd: Fix crash due to race between amd_pmu_enable_all, perf NMI and throttling amd_pmu_enable_all() does: if (!test_bit(idx, cpuc->active_mask)) continue; amd_pmu_enable_event(cpuc->events[idx]); A perf NMI of another event can come between these two steps. Perf NMI handler internally disables and enables _all_ events, including the one which nmi-intercepted amd_pmu_enable_all() was in process of enabling. If that unintentionally enabled event has very low sampling period and causes immediate successive NMI, causing the event to be throttled, cpuc->events[idx] and cpuc->active_mask gets cleared by x86_pmu_stop(). This will result in amd_pmu_enable_event() getting called with event=NULL when amd_pmu_enable_all() resumes after handling the NMIs. This causes a kernel crash: BUG: kernel NULL pointer dereference, address: 0000000000000198 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page [...] Call Trace: <TASK> amd_pmu_enable_all+0x68/0xb0 ctx_resched+0xd9/0x150 event_function+0xb8/0x130 ? hrtimer_start_range_ns+0x141/0x4a0 ? perf_duration_warn+0x30/0x30 remote_function+0x4d/0x60 __flush_smp_call_function_queue+0xc4/0x500 flush_smp_call_function_queue+0x11d/0x1b0 do_idle+0x18f/0x2d0 cpu_startup_entry+0x19/0x20 start_secondary+0x121/0x160 secondary_startup_64_no_verify+0xe5/0xeb </TASK> amd_pmu_disable_all()/amd_pmu_enable_all() calls inside perf NMI handler were recently added as part of BRS enablement but I'm not sure whether we really need them. We can just disable BRS in the beginning and enable it back while returning from NMI. This will solve the issue by not enabling those events whose active_masks are set but are not yet enabled in hw pmu.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/baa014b9543c8e5e94f5d15b66abfe60750b8284
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/fd5e454b856ed86b090336e269695d9908609b71
Impacted products
Vendor Product Version
Linux Linux Version: ada543459cab7f653dcacdaba4011a8bb19c627c
Version: ada543459cab7f653dcacdaba4011a8bb19c627c
 Create a notification for this product.
   Linux Linux Version: 5.19
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/events/amd/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fd5e454b856ed86b090336e269695d9908609b71",
              "status": "affected",
              "version": "ada543459cab7f653dcacdaba4011a8bb19c627c",
              "versionType": "git"
            },
            {
              "lessThan": "baa014b9543c8e5e94f5d15b66abfe60750b8284",
              "status": "affected",
              "version": "ada543459cab7f653dcacdaba4011a8bb19c627c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/events/amd/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.19"
            },
            {
              "lessThan": "5.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.10",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/x86/amd: Fix crash due to race between amd_pmu_enable_all, perf NMI and throttling\n\namd_pmu_enable_all() does:\n\n      if (!test_bit(idx, cpuc-\u003eactive_mask))\n              continue;\n\n      amd_pmu_enable_event(cpuc-\u003eevents[idx]);\n\nA perf NMI of another event can come between these two steps. Perf NMI\nhandler internally disables and enables _all_ events, including the one\nwhich nmi-intercepted amd_pmu_enable_all() was in process of enabling.\nIf that unintentionally enabled event has very low sampling period and\ncauses immediate successive NMI, causing the event to be throttled,\ncpuc-\u003eevents[idx] and cpuc-\u003eactive_mask gets cleared by x86_pmu_stop().\nThis will result in amd_pmu_enable_event() getting called with event=NULL\nwhen amd_pmu_enable_all() resumes after handling the NMIs. This causes a\nkernel crash:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000198\n  #PF: supervisor read access in kernel mode\n  #PF: error_code(0x0000) - not-present page\n  [...]\n  Call Trace:\n   \u003cTASK\u003e\n   amd_pmu_enable_all+0x68/0xb0\n   ctx_resched+0xd9/0x150\n   event_function+0xb8/0x130\n   ? hrtimer_start_range_ns+0x141/0x4a0\n   ? perf_duration_warn+0x30/0x30\n   remote_function+0x4d/0x60\n   __flush_smp_call_function_queue+0xc4/0x500\n   flush_smp_call_function_queue+0x11d/0x1b0\n   do_idle+0x18f/0x2d0\n   cpu_startup_entry+0x19/0x20\n   start_secondary+0x121/0x160\n   secondary_startup_64_no_verify+0xe5/0xeb\n   \u003c/TASK\u003e\n\namd_pmu_disable_all()/amd_pmu_enable_all() calls inside perf NMI handler\nwere recently added as part of BRS enablement but I\u0027m not sure whether\nwe really need them. We can just disable BRS in the beginning and enable\nit back while returning from NMI. This will solve the issue by not\nenabling those events whose active_masks are set but are not yet enabled\nin hw pmu."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T08:45:14.518Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fd5e454b856ed86b090336e269695d9908609b71"
        },
        {
          "url": "https://git.kernel.org/stable/c/baa014b9543c8e5e94f5d15b66abfe60750b8284"
        }
      ],
      "title": "perf/x86/amd: Fix crash due to race between amd_pmu_enable_all, perf NMI and throttling",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49781",
    "datePublished": "2025-05-01T14:09:15.775Z",
    "dateReserved": "2025-04-16T07:17:33.806Z",
    "dateUpdated": "2025-05-04T08:45:14.518Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49781\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-05-01T15:16:01.307\",\"lastModified\":\"2025-05-02T13:53:20.943\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nperf/x86/amd: Fix crash due to race between amd_pmu_enable_all, perf NMI and throttling\\n\\namd_pmu_enable_all() does:\\n\\n      if (!test_bit(idx, cpuc-\u003eactive_mask))\\n              continue;\\n\\n      amd_pmu_enable_event(cpuc-\u003eevents[idx]);\\n\\nA perf NMI of another event can come between these two steps. Perf NMI\\nhandler internally disables and enables _all_ events, including the one\\nwhich nmi-intercepted amd_pmu_enable_all() was in process of enabling.\\nIf that unintentionally enabled event has very low sampling period and\\ncauses immediate successive NMI, causing the event to be throttled,\\ncpuc-\u003eevents[idx] and cpuc-\u003eactive_mask gets cleared by x86_pmu_stop().\\nThis will result in amd_pmu_enable_event() getting called with event=NULL\\nwhen amd_pmu_enable_all() resumes after handling the NMIs. This causes a\\nkernel crash:\\n\\n  BUG: kernel NULL pointer dereference, address: 0000000000000198\\n  #PF: supervisor read access in kernel mode\\n  #PF: error_code(0x0000) - not-present page\\n  [...]\\n  Call Trace:\\n   \u003cTASK\u003e\\n   amd_pmu_enable_all+0x68/0xb0\\n   ctx_resched+0xd9/0x150\\n   event_function+0xb8/0x130\\n   ? hrtimer_start_range_ns+0x141/0x4a0\\n   ? perf_duration_warn+0x30/0x30\\n   remote_function+0x4d/0x60\\n   __flush_smp_call_function_queue+0xc4/0x500\\n   flush_smp_call_function_queue+0x11d/0x1b0\\n   do_idle+0x18f/0x2d0\\n   cpu_startup_entry+0x19/0x20\\n   start_secondary+0x121/0x160\\n   secondary_startup_64_no_verify+0xe5/0xeb\\n   \u003c/TASK\u003e\\n\\namd_pmu_disable_all()/amd_pmu_enable_all() calls inside perf NMI handler\\nwere recently added as part of BRS enablement but I\u0027m not sure whether\\nwe really need them. We can just disable BRS in the beginning and enable\\nit back while returning from NMI. This will solve the issue by not\\nenabling those events whose active_masks are set but are not yet enabled\\nin hw pmu.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: perf/x86/amd: Se corrige el fallo debido a la competencia entre amd_pmu_enable_all, perf NMI y la limitaci\u00f3n. amd_pmu_enable_all() realiza lo siguiente: if (!test_bit(idx, cpuc-\u0026gt;active_mask)) continue; amd_pmu_enable_event(cpuc-\u0026gt;events[idx]); Un perf NMI de otro evento puede interponerse entre estos dos pasos. El controlador de perf NMI deshabilita y habilita internamente _todos_ los eventos, incluido el que amd_pmu_enable_all() interceptado por nmi estaba habilitando. Si ese evento habilitado involuntariamente tiene un per\u00edodo de muestreo muy bajo y causa NMI sucesivas inmediatas, lo que provoca su limitaci\u00f3n, x86_pmu_stop() borra cpuc-\u0026gt;events[idx] y cpuc-\u0026gt;active_mask. Esto provocar\u00e1 que amd_pmu_enable_event() se llame con event=NULL cuando amd_pmu_enable_all() se reanude tras gestionar las NMI. Esto provoca un fallo del kernel: BUG: kernel NULL pointer dereference, address: 0000000000000198 #PF: acceso de lectura del supervisor en modo kernel #PF: error_code(0x0000) - not-present page [...] Rastreo de llamadas:   amd_pmu_enable_all+0x68/0xb0 ctx_resched+0xd9/0x150 event_function+0xb8/0x130 ? hrtimer_start_range_ns+0x141/0x4a0 ? perf_duration_warn+0x30/0x30 remote_function+0x4d/0x60 __flush_smp_call_function_queue+0xc4/0x500 flush_smp_call_function_queue+0x11d/0x1b0 do_idle+0x18f/0x2d0 cpu_startup_entry+0x19/0x20 start_secondary+0x121/0x160 secondary_startup_64_no_verify+0xe5/0xeb  amd_pmu_disable_all()/amd_pmu_enable_all() Las llamadas dentro del controlador NMI de rendimiento se a\u00f1adieron recientemente como parte de la habilitaci\u00f3n de BRS, pero no estoy seguro de si realmente las necesitamos. Podemos deshabilitar BRS al principio y volver a habilitarlo al regresar de NMI. Esto solucionar\u00e1 el problema al no habilitar los eventos cuyas m\u00e1scaras activas est\u00e9n configuradas, pero que a\u00fan no est\u00e9n habilitadas en la PMU de hardware.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/baa014b9543c8e5e94f5d15b66abfe60750b8284\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fd5e454b856ed86b090336e269695d9908609b71\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.