Linux Kernel up to 5.18.14 lbr_from_signext_quirk_needed privilege escalation

Summaryinfo

A vulnerability classified as problematic has been found in Linux Kernel up to 5.18.14. This impacts the function lbr_from_signext_quirk_needed. This manipulation causes an unknown weakness. This vulnerability appears as CVE-2022-49565. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in Linux Kernel up to 5.18.14. The impact remains unknown. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel/lbr: Fix unchecked MSR access error on HSW The fuzzer triggers the below trace. [ 7763.384369] unchecked MSR access error: WRMSR to 0x689 (tried to write 0x1fffffff8101349e) at rIP: 0xffffffff810704a4 (native_write_msr+0x4/0x20) [ 7763.397420] Call Trace: [ 7763.399881] [ 7763.401994] intel_pmu_lbr_restore+0x9a/0x1f0 [ 7763.406363] intel_pmu_lbr_sched_task+0x91/0x1c0 [ 7763.410992] __perf_event_task_sched_in+0x1cd/0x240 On a machine with the LBR format LBR_FORMAT_EIP_FLAGS2, when the TSX is disabled, a TSX quirk is required to access LBR from registers. The lbr_from_signext_quirk_needed() is introduced to determine whether the TSX quirk should be applied. However, the lbr_from_signext_quirk_needed() is invoked before the intel_pmu_lbr_init(), which parses the LBR format information. Without the correct LBR format information, the TSX quirk never be applied. Move the lbr_from_signext_quirk_needed() into the intel_pmu_lbr_init(). Checking x86_pmu.lbr_has_tsx in the lbr_from_signext_quirk_needed() is not required anymore. Both LBR_FORMAT_EIP_FLAGS2 and LBR_FORMAT_INFO have LBR_TSX flag, but only the LBR_FORMAT_EIP_FLAGS2 requirs the quirk. Update the comments accordingly.

It is possible to read the advisory at git.kernel.org. This vulnerability is known as CVE-2022-49565 since 02/26/2025. The exploitation appears to be difficult. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 245566 (Linux Distros Unpatched Vulnerability : CVE-2022-49565), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 5.18.15 eliminates this vulnerability. Applying the patch 625bcd0685a1612225df83468c83412fc0edb3d7/b0380e13502adf7dd8be4c47d622c3522aae6c63 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (245566). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 5.18.0
• 5.18.1
• 5.18.2
• 5.18.3
• 5.18.4
• 5.18.5
• 5.18.6
• 5.18.7
• 5.18.8
• 5.18.9
• 5.18.10
• 5.18.11
• 5.18.12
• 5.18.13
• 5.18.14

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion