CVE-2022-49196

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

powerpc/pseries: Fix use after free in remove_phb_dynamic()

In remove_phb_dynamic() we use &phb->io_resource, after we've called

device_unregister(&host_bridge->dev). But the unregister may have freed

phb, because pcibios_free_controller_deferred() is the release function

for the host_bridge.

If there are no outstanding references when we call device_unregister()

then phb will be freed out from under us.

This has gone mainly unnoticed, but with slub_debug and page_poison

enabled it can lead to a crash:

PID: 7574 TASK: c0000000d492cb80 CPU: 13 COMMAND: "drmgr"

#0 [c0000000e4f075a0] crash_kexec at c00000000027d7dc

#1 [c0000000e4f075d0] oops_end at c000000000029608

#2 [c0000000e4f07650] __bad_page_fault at c0000000000904b4

#3 [c0000000e4f076c0] do_bad_slb_fault at c00000000009a5a8

#4 [c0000000e4f076f0] data_access_slb_common_virt at c000000000008b30

Data SLB Access [380] exception frame:

R0

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References