CVE-2022-49851

一、漏洞信息
 漏洞编号：[CVE-2022-49851](https://nvd.nist.gov/vuln/detail/CVE-2022-49851)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：N/A None
  Vector：CVSS：3.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:riscv: fix reserved memory setupCurrently, RISC-V sets up reserved memory using the  early  copy of thedevice tree. As a result, when trying to get a reserved memory regionusing of_reserved_mem_lookup(), the pointer to reserved memory regionsis using the early, pre-virtual-memory address which causes a kernelpanic when trying to use the buffer s name: Unable to handle kernel paging request at virtual address 00000000401c31ac Oops [#1] Modules linked in: CPU: 0 PID: 0 Comm: swapper Not tainted 6.0.0-rc1-00001-g0d9d6953d834 #1 Hardware name: Microchip PolarFire-SoC Icicle Kit (DT) epc : string+0x4a/0xea  ra : vsnprintf+0x1e4/0x336 epc : ffffffff80335ea0 ra : ffffffff80338936 sp : ffffffff81203be0  gp : ffffffff812e0a98 tp : ffffffff8120de40 t0 : 0000000000000000  t1 : ffffffff81203e28 t2 : 7265736572203a46 s0 : ffffffff81203c20  s1 : ffffffff81203e28 a0 : ffffffff81203d22 a1 : 0000000000000000  a2 : ffffffff81203d08 a3 : 0000000081203d21 a4 : ffffffffffffffff  a5 : 00000000401c31ac a6 : ffff0a00ffffff04 a7 : ffffffffffffffff  s2 : ffffffff81203d08 s3 : ffffffff81203d00 s4 : 0000000000000008  s5 : ffffffff000000ff s6 : 0000000000ffffff s7 : 00000000ffffff00  s8 : ffffffff80d9821a s9 : ffffffff81203d22 s10: 0000000000000002  s11: ffffffff80d9821c t3 : ffffffff812f3617 t4 : ffffffff812f3617  t5 : ffffffff812f3618 t6 : ffffffff81203d08 status: 0000000200000100 badaddr: 00000000401c31ac cause: 000000000000000d [<ffffffff80338936>] vsnprintf+0x1e4/0x336 [<ffffffff80055ae2>] vprintk_store+0xf6/0x344 [<ffffffff80055d86>] vprintk_emit+0x56/0x192 [<ffffffff80055ed8>] vprintk_default+0x16/0x1e [<ffffffff800563d2>] vprintk+0x72/0x80 [<ffffffff806813b2>] _printk+0x36/0x50 [<ffffffff8068af48>] print_reserved_mem+0x1c/0x24 [<ffffffff808057ec>] paging_init+0x528/0x5bc [<ffffffff808031ae>] setup_arch+0xd0/0x592 [<ffffffff8080070e>] start_kernel+0x82/0x73cearly_init_fdt_scan_reserved_mem() takes no arguments as it operates oninitial_boot_params, which is populated by early_init_dt_verify(). OnRISC-V, early_init_dt_verify() is called twice. Once, directly, insetup_arch() if CONFIG_BUILTIN_DTB is not enabled and once indirectly,very early in the boot process, by parse_dtb() when it callsearly_init_dt_scan_nodes().This first call uses dtb_early_va to set initial_boot_params, which isnot usable later in the boot process whenearly_init_fdt_scan_reserved_mem() is called. On arm64 for example, thecorresponding call to early_init_dt_scan_nodes() uses fixmap addressesand doesn t suffer the same fate.Move early_init_fdt_scan_reserved_mem() further along the boot sequence,after the direct call to early_init_dt_verify() in setup_arch() so thatthe names use the correct virtual memory addresses. The above supposedthat CONFIG_BUILTIN_DTB was not set, but should work equally in the casewhere it is - unflatted_and_copy_device_tree() also updatesinitial_boot_params.
 漏洞公开时间：2025-05-01 23:16:08
 漏洞创建时间：2025-05-02 01:21:35
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2022-49851
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/50e63dd8ed92045eb70a72d7ec725488320fb68b |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/518e49f0590de66555503aabe199ba8d3f2e24ac |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/93598deb101540c4f9e7de15099ea8255b965fc2 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/94ab8f88feb75e3b1486102c0c9c550f37d9d137 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-49851 | https://bugzilla.suse.com/show_bug.cgi?id=1242329 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2022-49851 | https://bugzilla.suse.com/show_bug.cgi?id=1242329 |
| suse_bugzilla | https://git.kernel.org/stable/c/50e63dd8ed92045eb70a72d7ec725488320fb68b | https://bugzilla.suse.com/show_bug.cgi?id=1242329 |
| suse_bugzilla | https://git.kernel.org/stable/c/518e49f0590de66555503aabe199ba8d3f2e24ac | https://bugzilla.suse.com/show_bug.cgi?id=1242329 |
| suse_bugzilla | https://git.kernel.org/stable/c/93598deb101540c4f9e7de15099ea8255b965fc2 | https://bugzilla.suse.com/show_bug.cgi?id=1242329 |
| suse_bugzilla | https://git.kernel.org/stable/c/94ab8f88feb75e3b1486102c0c9c550f37d9d137 | https://bugzilla.suse.com/show_bug.cgi?id=1242329 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2022/CVE-2022-49851.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1242329 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2363500 | https://bugzilla.suse.com/show_bug.cgi?id=1242329 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2022-49851 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

无
</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:riscv: fix reserved memory setupCurrently, RISC-V sets up reserved memory using the &#34;early&#34; copy of thedevice tree. As a result, when trying to get a reserved memory regionusing of_reserved_mem_lookup(), the pointer to reserved memory regionsis using the early, pre-virtual-memory address which causes a kernelpanic when trying to use the buffer&#39;s name: Unable to handle kernel paging request at virtual address 00000000401c31ac Oops [#1] Modules linked in: CPU: 0 PID: 0 Comm: swapper Not tainted 6.0.0-rc1-00001-g0d9d6953d834 #1 Hardware name: Microchip PolarFire-SoC Icicle Kit (DT) epc : string+0x4a/0xea  ra : vsnprintf+0x1e4/0x336 epc : ffffffff80335ea0 ra : ffffffff80338936 sp : ffffffff81203be0  gp : ffffffff812e0a98 tp : ffffffff8120de40 t0 : 0000000000000000  t1 : ffffffff81203e28 t2 : 7265736572203a46 s0 : ffffffff81203c20  s1 : ffffffff81203e28 a0 : ffffffff81203d22 a1 : 0000000000000000  a2 : ffffffff81203d08 a3 : 0000000081203d21 a4 : ffffffffffffffff  a5 : 00000000401c31ac a6 : ffff0a00ffffff04 a7 : ffffffffffffffff  s2 : ffffffff81203d08 s3 : ffffffff81203d00 s4 : 0000000000000008  s5 : ffffffff000000ff s6 : 0000000000ffffff s7 : 00000000ffffff00  s8 : ffffffff80d9821a s9 : ffffffff81203d22 s10: 0000000000000002  s11: ffffffff80d9821c t3 : ffffffff812f3617 t4 : ffffffff812f3617  t5 : ffffffff812f3618 t6 : ffffffff81203d08 status: 0000000200000100 badaddr: 00000000401c31ac cause: 000000000000000d [&lt;ffffffff80338936&gt;] vsnprintf+0x1e4/0x336 [&lt;ffffffff80055ae2&gt;] vprintk_store+0xf6/0x344 [&lt;ffffffff80055d86&gt;] vprintk_emit+0x56/0x192 [&lt;ffffffff80055ed8&gt;] vprintk_default+0x16/0x1e [&lt;ffffffff800563d2&gt;] vprintk+0x72/0x80 [&lt;ffffffff806813b2&gt;] _printk+0x36/0x50 [&lt;ffffffff8068af48&gt;] print_reserved_mem+0x1c/0x24 [&lt;ffffffff808057ec&gt;] paging_init+0x528/0x5bc [&lt;ffffffff808031ae&gt;] setup_arch+0xd0/0x592 [&lt;ffffffff8080070e&gt;] start_kernel+0x82/0x73cearly_init_fdt_scan_reserved_mem() takes no arguments as it operates oninitial_boot_params, which is populated by early_init_dt_verify(). OnRISC-V, early_init_dt_verify() is called twice. Once, directly, insetup_arch() if CONFIG_BUILTIN_DTB is not enabled and once indirectly,very early in the boot process, by parse_dtb() when it callsearly_init_dt_scan_nodes().This first call uses dtb_early_va to set initial_boot_params, which isnot usable later in the boot process whenearly_init_fdt_scan_reserved_mem() is called. On arm64 for example, thecorresponding call to early_init_dt_scan_nodes() uses fixmap addressesand doesn&#39;t suffer the same fate.Move early_init_fdt_scan_reserved_mem() further along the boot sequence,after the direct call to early_init_dt_verify() in setup_arch() so thatthe names use the correct virtual memory addresses. The above supposedthat CONFIG_BUILTIN_DTB was not set, but should work equally in the casewhere it is - unflatted_and_copy_device_tree() also updatesinitial_boot_params.The Linux kernel CVE team has assigned CVE-2022-49851 to this issue.
 openEuler评分：
  3.9
 Vector：CVSS：3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
 受影响版本排查(受影响/不受影响)：
  1.master(6.6.0):不受影响
2.openEuler-20.03-LTS-SP4(4.19.90):不受影响
3.openEuler-22.03-LTS-SP3(5.10.0):不受影响
4.openEuler-22.03-LTS-SP4(5.10.0):不受影响
5.openEuler-24.03-LTS(6.6.0):不受影响
6.openEuler-24.03-LTS-Next(6.6.0):不受影响
7.openEuler-24.03-LTS-SP1(6.6.0):不受影响
8.openEuler-24.03-LTS-SP2(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.master(6.6.0):否
2.openEuler-20.03-LTS-SP4(4.19.90):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.openEuler-22.03-LTS-SP4(5.10.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-24.03-LTS-SP1(6.6.0):否
8.openEuler-24.03-LTS-SP2(6.6.0):否

原因说明：
  1.master(6.6.0):不受影响-漏洞代码不能被攻击者触发
2.openEuler-22.03-LTS-SP3(5.10.0):不受影响-漏洞代码不能被攻击者触发
3.openEuler-22.03-LTS-SP4(5.10.0):不受影响-漏洞代码不能被攻击者触发
4.openEuler-24.03-LTS(6.6.0):不受影响-漏洞代码不能被攻击者触发
5.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发
6.openEuler-24.03-LTS-SP1(6.6.0):不受影响-漏洞代码不能被攻击者触发
7.openEuler-24.03-LTS-SP2(6.6.0):不受影响-漏洞代码不能被攻击者触发
8.openEuler-20.03-LTS-SP4(4.19.90):不受影响-漏洞代码不存在

src-openEuler/kernel

内容风险标识

评论 (5)

src-openEuler/kernel .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2022-49851

评论 (5)

搜索帮助

src-openEuler/kernel