CVE-2022-48921

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

sched/fair: Fix fault in reweight_entity

Syzbot found a GPF in reweight_entity. This has been bisected to

commit 4ef0c5c6b5ba ("kernel/sched: Fix sched_fork() access an invalid

sched_task_group")

There is a race between sched_post_fork() and setpriority(PRIO_PGRP)

within a thread group that causes a null-ptr-deref in

reweight_entity() in CFS. The scenario is that the main process spawns

number of new threads, which then call setpriority(PRIO_PGRP, 0, -20),

wait, and exit. For each of the new threads the copy_process() gets

invoked, which adds the new task_struct and calls sched_post_fork()

for it.

In the above scenario there is a possibility that

setpriority(PRIO_PGRP) and set_one_prio() will be called for a thread

in the group that is just being created by copy_process(), and for

which the sched_post_fork() has not been executed yet. This will

trigger a null pointer dereference in reweight_entity(), as it will

tr

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References