CVE-2022-49554 (GCVE-0-2022-49554)

Vulnerability from cvelistv5 – Published: 2025-02-26 02:14 – Updated: 2025-05-04 08:40
VLAI?
Title
zsmalloc: fix races between asynchronous zspage free and page migration
Summary
In the Linux kernel, the following vulnerability has been resolved: zsmalloc: fix races between asynchronous zspage free and page migration The asynchronous zspage free worker tries to lock a zspage's entire page list without defending against page migration. Since pages which haven't yet been locked can concurrently migrate off the zspage page list while lock_zspage() churns away, lock_zspage() can suffer from a few different lethal races. It can lock a page which no longer belongs to the zspage and unsafely dereference page_private(), it can unsafely dereference a torn pointer to the next page (since there's a data race), and it can observe a spurious NULL pointer to the next page and thus not lock all of the zspage's pages (since a single page migration will reconstruct the entire page list, and create_page_chain() unconditionally zeroes out each list pointer in the process). Fix the races by using migrate_read_lock() in lock_zspage() to synchronize with page migration.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 77ff465799c60294e248000cd22ae8171da3304c , < 3674d8a8dadd03a447dd21069d4dacfc3399b63b (git)
Affected: 77ff465799c60294e248000cd22ae8171da3304c , < 645996efc2ae391246d595832aaa6f9d3cc338c7 (git)
Affected: 77ff465799c60294e248000cd22ae8171da3304c , < fc658c083904427abbf8f18280d517ee2668677c (git)
Affected: 77ff465799c60294e248000cd22ae8171da3304c , < fae05b2314b147a78fbed1dc4c645d9a66313758 (git)
Affected: 77ff465799c60294e248000cd22ae8171da3304c , < 3ec459c8810e658401be428d3168eacfc380bdd0 (git)
Affected: 77ff465799c60294e248000cd22ae8171da3304c , < 8ba7b7c1dad1f6503c541778f31b33f7f62eb966 (git)
Affected: 77ff465799c60294e248000cd22ae8171da3304c , < c5402fb5f71f1a725f1e55d9c6799c0c7bec308f (git)
Affected: 77ff465799c60294e248000cd22ae8171da3304c , < 2505a981114dcb715f8977b8433f7540854851d8 (git)
Create a notification for this product.
    Linux Linux Affected: 4.14
Unaffected: 0 , < 4.14 (semver)
Unaffected: 4.14.282 , ≤ 4.14.* (semver)
Unaffected: 4.19.246 , ≤ 4.19.* (semver)
Unaffected: 5.4.197 , ≤ 5.4.* (semver)
Unaffected: 5.10.120 , ≤ 5.10.* (semver)
Unaffected: 5.15.45 , ≤ 5.15.* (semver)
Unaffected: 5.17.13 , ≤ 5.17.* (semver)
Unaffected: 5.18.2 , ≤ 5.18.* (semver)
Unaffected: 5.19 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/zsmalloc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3674d8a8dadd03a447dd21069d4dacfc3399b63b",
              "status": "affected",
              "version": "77ff465799c60294e248000cd22ae8171da3304c",
              "versionType": "git"
            },
            {
              "lessThan": "645996efc2ae391246d595832aaa6f9d3cc338c7",
              "status": "affected",
              "version": "77ff465799c60294e248000cd22ae8171da3304c",
              "versionType": "git"
            },
            {
              "lessThan": "fc658c083904427abbf8f18280d517ee2668677c",
              "status": "affected",
              "version": "77ff465799c60294e248000cd22ae8171da3304c",
              "versionType": "git"
            },
            {
              "lessThan": "fae05b2314b147a78fbed1dc4c645d9a66313758",
              "status": "affected",
              "version": "77ff465799c60294e248000cd22ae8171da3304c",
              "versionType": "git"
            },
            {
              "lessThan": "3ec459c8810e658401be428d3168eacfc380bdd0",
              "status": "affected",
              "version": "77ff465799c60294e248000cd22ae8171da3304c",
              "versionType": "git"
            },
            {
              "lessThan": "8ba7b7c1dad1f6503c541778f31b33f7f62eb966",
              "status": "affected",
              "version": "77ff465799c60294e248000cd22ae8171da3304c",
              "versionType": "git"
            },
            {
              "lessThan": "c5402fb5f71f1a725f1e55d9c6799c0c7bec308f",
              "status": "affected",
              "version": "77ff465799c60294e248000cd22ae8171da3304c",
              "versionType": "git"
            },
            {
              "lessThan": "2505a981114dcb715f8977b8433f7540854851d8",
              "status": "affected",
              "version": "77ff465799c60294e248000cd22ae8171da3304c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/zsmalloc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.14"
            },
            {
              "lessThan": "4.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.282",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.246",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.197",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.282",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.246",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.197",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.120",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.45",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.13",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.2",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nzsmalloc: fix races between asynchronous zspage free and page migration\n\nThe asynchronous zspage free worker tries to lock a zspage\u0027s entire page\nlist without defending against page migration.  Since pages which haven\u0027t\nyet been locked can concurrently migrate off the zspage page list while\nlock_zspage() churns away, lock_zspage() can suffer from a few different\nlethal races.\n\nIt can lock a page which no longer belongs to the zspage and unsafely\ndereference page_private(), it can unsafely dereference a torn pointer to\nthe next page (since there\u0027s a data race), and it can observe a spurious\nNULL pointer to the next page and thus not lock all of the zspage\u0027s pages\n(since a single page migration will reconstruct the entire page list, and\ncreate_page_chain() unconditionally zeroes out each list pointer in the\nprocess).\n\nFix the races by using migrate_read_lock() in lock_zspage() to synchronize\nwith page migration."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T08:40:26.141Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3674d8a8dadd03a447dd21069d4dacfc3399b63b"
        },
        {
          "url": "https://git.kernel.org/stable/c/645996efc2ae391246d595832aaa6f9d3cc338c7"
        },
        {
          "url": "https://git.kernel.org/stable/c/fc658c083904427abbf8f18280d517ee2668677c"
        },
        {
          "url": "https://git.kernel.org/stable/c/fae05b2314b147a78fbed1dc4c645d9a66313758"
        },
        {
          "url": "https://git.kernel.org/stable/c/3ec459c8810e658401be428d3168eacfc380bdd0"
        },
        {
          "url": "https://git.kernel.org/stable/c/8ba7b7c1dad1f6503c541778f31b33f7f62eb966"
        },
        {
          "url": "https://git.kernel.org/stable/c/c5402fb5f71f1a725f1e55d9c6799c0c7bec308f"
        },
        {
          "url": "https://git.kernel.org/stable/c/2505a981114dcb715f8977b8433f7540854851d8"
        }
      ],
      "title": "zsmalloc: fix races between asynchronous zspage free and page migration",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49554",
    "datePublished": "2025-02-26T02:14:02.649Z",
    "dateReserved": "2025-02-26T02:08:31.590Z",
    "dateUpdated": "2025-05-04T08:40:26.141Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49554\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-26T07:01:31.223\",\"lastModified\":\"2025-10-22T17:33:36.960\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nzsmalloc: fix races between asynchronous zspage free and page migration\\n\\nThe asynchronous zspage free worker tries to lock a zspage\u0027s entire page\\nlist without defending against page migration.  Since pages which haven\u0027t\\nyet been locked can concurrently migrate off the zspage page list while\\nlock_zspage() churns away, lock_zspage() can suffer from a few different\\nlethal races.\\n\\nIt can lock a page which no longer belongs to the zspage and unsafely\\ndereference page_private(), it can unsafely dereference a torn pointer to\\nthe next page (since there\u0027s a data race), and it can observe a spurious\\nNULL pointer to the next page and thus not lock all of the zspage\u0027s pages\\n(since a single page migration will reconstruct the entire page list, and\\ncreate_page_chain() unconditionally zeroes out each list pointer in the\\nprocess).\\n\\nFix the races by using migrate_read_lock() in lock_zspage() to synchronize\\nwith page migration.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: zsmalloc: arregla las ejecuciones entre la liberaci\u00f3n asincr\u00f3nica de zspage y la migraci\u00f3n de p\u00e1gina El trabajador de liberaci\u00f3n asincr\u00f3nica de zspage intenta bloquear la lista completa de p\u00e1ginas de una zspage sin defenderse contra la migraci\u00f3n de p\u00e1gina. Dado que las p\u00e1ginas que a\u00fan no se han bloqueado pueden migrar simult\u00e1neamente fuera de la lista de p\u00e1ginas de la zspage mientras lock_zspage() se procesa, lock_zspage() puede sufrir algunas ejecuciones letales diferentes. Puede bloquear una p\u00e1gina que ya no pertenece a la zspage y desreferenciar de forma insegura page_private(), puede desreferenciar de forma insegura un puntero roto a la siguiente p\u00e1gina (ya que hay una ejecuci\u00f3n de datos), y puede observar un puntero NULL espurio a la siguiente p\u00e1gina y, por lo tanto, no bloquear todas las p\u00e1ginas de la zspage (ya que una sola migraci\u00f3n de p\u00e1gina reconstruir\u00e1 la lista de p\u00e1ginas completa, y create_page_chain() pone a cero incondicionalmente cada puntero de lista en el proceso). Corrija las ejecuciones usando migrants_read_lock() en lock_zspage() para sincronizar con la migraci\u00f3n de p\u00e1gina.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.14\",\"versionEndExcluding\":\"4.14.282\",\"matchCriteriaId\":\"D697ED37-2BFA-4A75-9665-BBC0B0BE0FC1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.15\",\"versionEndExcluding\":\"4.19.246\",\"matchCriteriaId\":\"FEDF30DC-BB12-4C4C-A134-AA5D59D73C0C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.197\",\"matchCriteriaId\":\"F7FDD830-741D-44F7-A537-13755A4314DE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.120\",\"matchCriteriaId\":\"92818976-ECCC-4744-9287-E2CF4B2C4131\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.45\",\"matchCriteriaId\":\"08D699AD-F4CE-4BDD-A97E-4997299C7712\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.17.13\",\"matchCriteriaId\":\"192FC54B-5367-49D6-B410-0285F14665B1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.18\",\"versionEndExcluding\":\"5.18.2\",\"matchCriteriaId\":\"9FF255A1-64F4-4E31-AF44-C92FB8773BA2\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2505a981114dcb715f8977b8433f7540854851d8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3674d8a8dadd03a447dd21069d4dacfc3399b63b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3ec459c8810e658401be428d3168eacfc380bdd0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/645996efc2ae391246d595832aaa6f9d3cc338c7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8ba7b7c1dad1f6503c541778f31b33f7f62eb966\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c5402fb5f71f1a725f1e55d9c6799c0c7bec308f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fae05b2314b147a78fbed1dc4c645d9a66313758\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fc658c083904427abbf8f18280d517ee2668677c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.