CVE-2022-49700

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm/slub: add missing TID updates on slab deactivation

The fastpath in slab_alloc_node() assumes that c->slab is stable as long as

the TID stays the same. However, two places in __slab_alloc() currently

don't update the TID when deactivating the CPU slab.

If multiple operations race the right way, this could lead to an object

getting lost; or, in an even more unlikely situation, it could even lead to

an object being freed onto the wrong slab's freelist, messing up the

`inuse` counter and eventually causing a page to be freed to the page

allocator while it still contains slab objects.

(I haven't actually tested these cases though, this is just based on

looking at the code. Writing testcases for this stuff seems like it'd be

a pain...)

The race leading to state inconsistency is (all operations on the same CPU

and kmem_cache):

- task A: begin do_slab_free():

- read TID

- read pcpu freelist (==NULL)

- che

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References