CVE-2022-49647

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

cgroup: Use separate src/dst nodes when preloading css_sets for migration

Each cset (css_set) is pinned by its tasks. When we're moving tasks around

across csets for a migration, we need to hold the source and destination

csets to ensure that they don't go away while we're moving tasks about. This

is done by linking cset->mg_preload_node on either the

mgctx->preloaded_src_csets or mgctx->preloaded_dst_csets list. Using the

same cset->mg_preload_node for both the src and dst lists was deemed okay as

a cset can't be both the source and destination at the same time.

Unfortunately, this overloading becomes problematic when multiple tasks are

involved in a migration and some of them are identity noop migrations while

others are actually moving across cgroups. For example, this can happen with

the following sequence on cgroup1:

#1> mkdir -p /sys/fs/cgroup/misc/a/b

#2> echo $$ > /sys/fs/cgroup/misc/a/cgroup.procs

#3> R

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References