CVE-2022-48892

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

sched/core: Fix use-after-free bug in dup_user_cpus_ptr()

Since commit 07ec77a1d4e8 ("sched: Allow task CPU affinity to be

restricted on asymmetric systems"), the setting and clearing of

user_cpus_ptr are done under pi_lock for arm64 architecture. However,

dup_user_cpus_ptr() accesses user_cpus_ptr without any lock

protection. Since sched_setaffinity() can be invoked from another

process, the process being modified may be undergoing fork() at

the same time. When racing with the clearing of user_cpus_ptr in

__set_cpus_allowed_ptr_locked(), it can lead to user-after-free and

possibly double-free in arm64 kernel.

Commit 8f9ea86fdf99 ("sched: Always preserve the user requested

cpumask") fixes this problem as user_cpus_ptr, once set, will never

be cleared in a task's lifetime. However, this bug was re-introduced

in commit 851a723e45d1 ("sched: Always clear user_cpus_ptr in

do_set_cpus_allowed()") which allows the cleari

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References