CVE-2022-49701

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

scsi: ibmvfc: Allocate/free queue resource only during probe/remove

Currently, the sub-queues and event pool resources are allocated/freed for

every CRQ connection event such as reset and LPM. This exposes the driver

to a couple issues. First the inefficiency of freeing and reallocating

memory that can simply be resued after being sanitized. Further, a system

under memory pressue runs the risk of allocation failures that could result

in a crippled driver. Finally, there is a race window where command

submission/compeletion can try to pull/return elements from/to an event

pool that is being deleted or already has been deleted due to the lack of

host state around freeing/allocating resources. The following is an example

of list corruption following a live partition migration (LPM):

Oops: Exception in kernel mode, sig: 5 [#1]

LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries

Modules linked in: vfat fat isofs cdro

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References