CVE-2022-49406

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

block: Fix potential deadlock in blk_ia_range_sysfs_show()

When being read, a sysfs attribute is already protected against removal

with the kobject node active reference counter. As a result, in

blk_ia_range_sysfs_show(), there is no need to take the queue sysfs

lock when reading the value of a range attribute. Using the queue sysfs

lock in this function creates a potential deadlock situation with the

disk removal, something that a lockdep signals with a splat when the

device is removed:

[ 760.703551] Possible unsafe locking scenario:

[ 760.703551]

[ 760.703554] CPU0 CPU1

[ 760.703556] ---- ----

[ 760.703558] lock(&q->sysfs_lock);

[ 760.703565] lock(kn->active#385);

[ 760.703573] lock(&q->sysfs_lock);

[ 760.703579] lock(kn->active#385);

[ 760.703587]

[ 760.703587] *** DEADLOCK ***

Solve

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References