CVE-2022-49703 in Linux
Summary
by MITRE • 02/26/2025
In the Linux kernel, the following vulnerability has been resolved:
scsi: ibmvfc: Store vhost pointer during subcrq allocation
Currently the back pointer from a queue to the vhost adapter isn't set until after subcrq interrupt registration. The value is available when a queue is first allocated and can/should be also set for primary and async queues as well as subcrqs.
This fixes a crash observed during kexec/kdump on Power 9 with legacy XICS interrupt controller where a pending subcrq interrupt from the previous kernel can be replayed immediately upon IRQ registration resulting in dereference of a garbage backpointer in ibmvfc_interrupt_scsi().
Kernel attempted to read user page (58) - exploit attempt? (uid: 0) BUG: Kernel NULL pointer dereference on read at 0x00000058 Faulting instruction address: 0xc008000003216a08 Oops: Kernel access of bad area, sig: 11 [#1]
... NIP [c008000003216a08] ibmvfc_interrupt_scsi+0x40/0xb0 [ibmvfc]
LR [c0000000082079e8] __handle_irq_event_percpu+0x98/0x270
Call Trace: [c000000047fa3d80] [c0000000123e6180] 0xc0000000123e6180 (unreliable)
[c000000047fa3df0] [c0000000082079e8] __handle_irq_event_percpu+0x98/0x270
[c000000047fa3ea0] [c000000008207d18] handle_irq_event+0x98/0x188
[c000000047fa3ef0] [c00000000820f564] handle_fasteoi_irq+0xc4/0x310
[c000000047fa3f40] [c000000008205c60] generic_handle_irq+0x50/0x80
[c000000047fa3f60] [c000000008015c40] __do_irq+0x70/0x1a0
[c000000047fa3f90] [c000000008016d7c] __do_IRQ+0x9c/0x130
[c000000014622f60] [0000000020000000] 0x20000000
[c000000014622ff0] [c000000008016e50] do_IRQ+0x40/0xa0
[c000000014623020] [c000000008017044] replay_soft_interrupts+0x194/0x2f0
[c000000014623210] [c0000000080172a8] arch_local_irq_restore+0x108/0x170
[c000000014623240] [c000000008eb1008] _raw_spin_unlock_irqrestore+0x58/0xb0
[c000000014623270] [c00000000820b12c] __setup_irq+0x49c/0x9f0
[c000000014623310] [c00000000820b7c0] request_threaded_irq+0x140/0x230
[c000000014623380] [c008000003212a50] ibmvfc_register_scsi_channel+0x1e8/0x2f0 [ibmvfc]
[c000000014623450] [c008000003213d1c] ibmvfc_init_sub_crqs+0xc4/0x1f0 [ibmvfc]
[c0000000146234d0] [c0080000032145a8] ibmvfc_reset_crq+0x150/0x210 [ibmvfc]
[c000000014623550] [c0080000032147c8] ibmvfc_init_crq+0x160/0x280 [ibmvfc]
[c0000000146235f0] [c00800000321a9cc] ibmvfc_probe+0x2a4/0x530 [ibmvfc]
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 02/26/2025
The vulnerability identified as CVE-2022-49703 affects the Linux kernel's IBM Virtual Fibre Channel (ibmvfc) driver, specifically within the SCSI subsystem on Power 9 systems utilizing legacy XICS interrupt controllers. This issue stems from a timing discrepancy in the initialization process of virtual host adapter queues where the back pointer from a queue to its corresponding vhost adapter is not properly established during the initial queue allocation phase. The driver's implementation fails to set this critical pointer reference for primary and asynchronous queues, as well as subchannel receive queues, until after interrupt registration occurs. This temporal gap creates a window where interrupt handlers might attempt to access uninitialized or invalid pointers, leading to kernel crashes and system instability. The vulnerability manifests particularly during kexec/kdump operations, where the kernel attempts to transition to a new kernel image while legacy interrupt controllers may replay pending interrupts from the previous kernel execution context. When such replayed interrupts occur immediately upon IRQ registration, they trigger the ibmvfc_interrupt_scsi() function which attempts to dereference a garbage pointer value, resulting in a kernel NULL pointer dereference and system crash. The technical flaw aligns with CWE-476, representing a NULL pointer dereference vulnerability that occurs due to improper initialization of object references. This issue demonstrates a classic race condition in kernel driver initialization where the sequence of operations creates an exploitable timing window. The operational impact extends beyond simple system crashes to potentially compromising system availability during critical operations such as system reboots or crash recovery scenarios. The vulnerability affects systems running Linux kernels on Power 9 architecture with legacy XICS interrupt handling, particularly in environments where kexec/kdump functionality is utilized for system recovery. The attack surface is limited to systems employing the ibmvfc SCSI driver, but the implications are severe as it can cause complete system hangs or crashes during critical system transitions. The fix implemented addresses the root cause by ensuring that the vhost pointer is stored during subcrq allocation rather than deferring this operation until after interrupt registration, thereby eliminating the window where invalid pointers could be dereferenced. This remediation follows the principle of early initialization and proper resource management, preventing the conditions that enable the NULL pointer dereference. The vulnerability's characteristics align with ATT&CK technique T1490, representing a system service interruption through kernel-level memory corruption, and T1547, involving kernel module manipulation that affects system stability. The specific crash pattern observed in the kernel logs shows the fault occurring at instruction address 0xc008000003216a08 within ibmvfc_interrupt_scsi, with a clear call trace demonstrating how the interrupt handling chain leads to the invalid memory access. The issue represents a critical reliability concern for enterprise systems relying on Power 9 infrastructure and kexec/kdump functionality for operational continuity. The fix ensures that all queue structures maintain valid backpointers from the moment they are allocated, preventing the replayed interrupt scenario from causing system crashes. This vulnerability highlights the importance of careful synchronization in kernel driver initialization and proper handling of interrupt contexts during system transitions, particularly in virtualized and high-availability environments where system stability is paramount. The resolution effectively closes the initialization race condition that enabled the NULL pointer dereference, thereby restoring system stability during critical kernel operations.