CVE-2022-49781

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

perf/x86/amd: Fix crash due to race between amd_pmu_enable_all, perf NMI and throttling

amd_pmu_enable_all() does:

if (!test_bit(idx, cpuc->active_mask))

continue;

amd_pmu_enable_event(cpuc->events[idx]);

A perf NMI of another event can come between these two steps. Perf NMI

handler internally disables and enables _all_ events, including the one

which nmi-intercepted amd_pmu_enable_all() was in process of enabling.

If that unintentionally enabled event has very low sampling period and

causes immediate successive NMI, causing the event to be throttled,

cpuc->events[idx] and cpuc->active_mask gets cleared by x86_pmu_stop().

This will result in amd_pmu_enable_event() getting called with event=NULL

when amd_pmu_enable_all() resumes after handling the NMIs. This causes a

kernel crash:

BUG: kernel NULL pointer dereference, address: 0000000000000198

#PF: supervisor read access in kernel mod

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References