CVE-2022-49783

一、漏洞信息
 漏洞编号：[CVE-2022-49783](https://nvd.nist.gov/vuln/detail/CVE-2022-49783)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：N/A None
  Vector：CVSS：3.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:x86/fpu: Drop fpregs lock before inheriting FPU permissionsMike Galbraith reported the following against an old fork of preempt-rtbut the same issue also applies to the current preempt-rt tree.   BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:46   in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1, name: systemd   preempt_count: 1, expected: 0   RCU nest depth: 0, expected: 0   Preemption disabled at:   fpu_clone   CPU: 6 PID: 1 Comm: systemd Tainted: G            E       (unreleased)   Call Trace:    <TASK>    dump_stack_lvl    ? fpu_clone    __might_resched    rt_spin_lock    fpu_clone    ? copy_thread    ? copy_process    ? shmem_alloc_inode    ? kmem_cache_alloc    ? kernel_clone    ? __do_sys_clone    ? do_syscall_64    ? __x64_sys_rt_sigprocmask    ? syscall_exit_to_user_mode    ? do_syscall_64    ? syscall_exit_to_user_mode    ? do_syscall_64    ? syscall_exit_to_user_mode    ? do_syscall_64    ? exc_page_fault    ? entry_SYSCALL_64_after_hwframe    </TASK>Mike says:  The splat comes from fpu_inherit_perms() being called under fpregs_lock(),  and us reaching the spin_lock_irq() therein due to fpu_state_size_dynamic()  returning true despite static key __fpu_state_size_dynamic having never  been enabled.Mike s assessment looks correct. fpregs_lock on a PREEMPT_RT kernel disablespreemption so calling spin_lock_irq() in fpu_inherit_perms() is unsafe. Thisproblem exists since commit  9e798e9aa14c ( x86/fpu: Prepare fpu_clone() for dynamically enabled features ).Even though the original bug report should not have enabled the paths atall, the bug still exists.fpregs_lock is necessary when editing the FPU registers or a task s FPstate but it is not necessary for fpu_inherit_perms(). The only writeof any FP state in fpu_inherit_perms() is for the new child which isnot running yet and cannot context switch or be borrowed by a kernelthread yet. Hence, fpregs_lock is not protecting anything in the newchild until clone() completes and can be dropped earlier. The siglockstill needs to be acquired by fpu_inherit_perms() as the read of theparent s permissions has to be serialised.  [ bp: Cleanup splat. ]
 漏洞公开时间：2025-05-01 23:16:01
 漏洞创建时间：2025-05-02 01:40:40
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2022-49783
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/36b038791e1e2baea892e9276588815fd14894b4 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/c6e8a7a1780af3da65e78a615f7d0874da6aabb0 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-49783 | https://bugzilla.suse.com/show_bug.cgi?id=1242312 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2022-49783 | https://bugzilla.suse.com/show_bug.cgi?id=1242312 |
| suse_bugzilla | https://git.kernel.org/stable/c/36b038791e1e2baea892e9276588815fd14894b4 | https://bugzilla.suse.com/show_bug.cgi?id=1242312 |
| suse_bugzilla | https://git.kernel.org/stable/c/c6e8a7a1780af3da65e78a615f7d0874da6aabb0 | https://bugzilla.suse.com/show_bug.cgi?id=1242312 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2022/CVE-2022-49783.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1242312 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2363405 | https://bugzilla.suse.com/show_bug.cgi?id=1242312 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2025050120-CVE-2022-49783-a870@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2363405 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2022-49783 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

无
</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:x86/fpu: Drop fpregs lock before inheriting FPU permissionsMike Galbraith reported the following against an old fork of preempt-rtbut the same issue also applies to the current preempt-rt tree.   BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:46   in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1, name: systemd   preempt_count: 1, expected: 0   RCU nest depth: 0, expected: 0   Preemption disabled at:   fpu_clone   CPU: 6 PID: 1 Comm: systemd Tainted: G            E       (unreleased)   Call Trace:    &lt;TASK&gt;    dump_stack_lvl    ? fpu_clone    __might_resched    rt_spin_lock    fpu_clone    ? copy_thread    ? copy_process    ? shmem_alloc_inode    ? kmem_cache_alloc    ? kernel_clone    ? __do_sys_clone    ? do_syscall_64    ? __x64_sys_rt_sigprocmask    ? syscall_exit_to_user_mode    ? do_syscall_64    ? syscall_exit_to_user_mode    ? do_syscall_64    ? syscall_exit_to_user_mode    ? do_syscall_64    ? exc_page_fault    ? entry_SYSCALL_64_after_hwframe    &lt;/TASK&gt;Mike says:  The splat comes from fpu_inherit_perms() being called under fpregs_lock(),  and us reaching the spin_lock_irq() therein due to fpu_state_size_dynamic()  returning true despite static key __fpu_state_size_dynamic having never  been enabled.Mike&#39;s assessment looks correct. fpregs_lock on a PREEMPT_RT kernel disablespreemption so calling spin_lock_irq() in fpu_inherit_perms() is unsafe. Thisproblem exists since commit  9e798e9aa14c (&#34;x86/fpu: Prepare fpu_clone() for dynamically enabled features&#34;).Even though the original bug report should not have enabled the paths atall, the bug still exists.fpregs_lock is necessary when editing the FPU registers or a task&#39;s FPstate but it is not necessary for fpu_inherit_perms(). The only writeof any FP state in fpu_inherit_perms() is for the new child which isnot running yet and cannot context switch or be borrowed by a kernelthread yet. Hence, fpregs_lock is not protecting anything in the newchild until clone() completes and can be dropped earlier. The siglockstill needs to be acquired by fpu_inherit_perms() as the read of theparent&#39;s permissions has to be serialised.  [ bp: Cleanup splat. ]The Linux kernel CVE team has assigned CVE-2022-49783 to this issue.
 openEuler评分：
  4.1
 Vector：CVSS：3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-22.03-LTS-SP3(5.10.0):受影响
2.openEuler-22.03-LTS-SP4(5.10.0):受影响
3.master(6.12.33):不受影响
4.openEuler-20.03-LTS-SP4(4.19.90):不受影响
5.openEuler-24.03-LTS:不受影响
6.openEuler-24.03-LTS-Next:不受影响
7.openEuler-24.03-LTS-SP1:不受影响
8.openEuler-24.03-LTS-SP2:不受影响

修复是否涉及abi变化(是/否)：
  1.master(6.12.33):否
2.openEuler-20.03-LTS-SP4(4.19.90):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.openEuler-22.03-LTS-SP4(5.10.0):否
5.openEuler-24.03-LTS:否
6.openEuler-24.03-LTS-Next:否
7.openEuler-24.03-LTS-SP1:否
8.openEuler-24.03-LTS-SP2:否

原因说明：
  1.openEuler-22.03-LTS-SP3(5.10.0):不修复-超出修复范围
2.openEuler-22.03-LTS-SP4(5.10.0):不修复-超出修复范围
3.master(6.12.33):不受影响-漏洞代码不能被攻击者触发
4.openEuler-24.03-LTS:不受影响-漏洞代码不能被攻击者触发
5.openEuler-24.03-LTS-Next:不受影响-漏洞代码不能被攻击者触发
6.openEuler-24.03-LTS-SP1:不受影响-漏洞代码不能被攻击者触发
7.openEuler-24.03-LTS-SP2:不受影响-漏洞代码不能被攻击者触发
8.openEuler-20.03-LTS-SP4(4.19.90):不受影响-漏洞代码不存在

src-openEuler / kernel
Closed

Content Risk Flag

Comments (5)

src-openEuler / kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2022-49783

Comments (5)

Search

src-openEuler / kernel
Closed