CVE-2022-49703

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

scsi: ibmvfc: Store vhost pointer during subcrq allocation

Currently the back pointer from a queue to the vhost adapter isn't set

until after subcrq interrupt registration. The value is available when a

queue is first allocated and can/should be also set for primary and async

queues as well as subcrqs.

This fixes a crash observed during kexec/kdump on Power 9 with legacy XICS

interrupt controller where a pending subcrq interrupt from the previous

kernel can be replayed immediately upon IRQ registration resulting in

dereference of a garbage backpointer in ibmvfc_interrupt_scsi().

Kernel attempted to read user page (58) - exploit attempt? (uid: 0)

BUG: Kernel NULL pointer dereference on read at 0x00000058

Faulting instruction address: 0xc008000003216a08

Oops: Kernel access of bad area, sig: 11 [#1]

...

NIP [c008000003216a08] ibmvfc_interrupt_scsi+0x40/0xb0 [ibmvfc]

LR [c0000000082079e8] __handle_irq_event_percpu+0x98

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References