CVE-2022-49152

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

XArray: Fix xas_create_range() when multi-order entry present

If there is already an entry present that is of order >= XA_CHUNK_SHIFT

when we call xas_create_range(), xas_create_range() will misinterpret

that entry as a node and dereference xa_node->parent, generally leading

to a crash that looks something like this:

general protection fault, probably for non-canonical address 0xdffffc0000000001:

0000 [#1] PREEMPT SMP KASAN

KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]

CPU: 0 PID: 32 Comm: khugepaged Not tainted 5.17.0-rc8-syzkaller-00003-g56e337f2cf13 #0

RIP: 0010:xa_parent_locked include/linux/xarray.h:1207 [inline]

RIP: 0010:xas_create_range+0x2d9/0x6e0 lib/xarray.c:725

It's deterministically reproducable once you know what the problem is,

but producing it in a live kernel requires khugepaged to hit a race.

While the problem has been present since xas_create_range() was

introduced, I'm n

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References