CVE-2022-49520

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

arm64: compat: Do not treat syscall number as ESR_ELx for a bad syscall

If a compat process tries to execute an unknown system call above the

__ARM_NR_COMPAT_END number, the kernel sends a SIGILL signal to the

offending process. Information about the error is printed to dmesg in

compat_arm_syscall() -> arm64_notify_die() -> arm64_force_sig_fault() ->

arm64_show_signal().

arm64_show_signal() interprets a non-zero value for

current->thread.fault_code as an exception syndrome and displays the

message associated with the ESR_ELx.EC field (bits 31:26).

current->thread.fault_code is set in compat_arm_syscall() ->

arm64_notify_die() with the bad syscall number instead of a valid ESR_ELx

value. This means that the ESR_ELx.EC field has the value that the user set

for the syscall number and the kernel can end up printing bogus exception

messages*. For example, for the syscall number 0x68000000, which evaluates

to ESR_ELx.EC v

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References