CVE-2022-49889

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ring-buffer: Check for NULL cpu_buffer in ring_buffer_wake_waiters()

On some machines the number of listed CPUs may be bigger than the actual

CPUs that exist. The tracing subsystem allocates a per_cpu directory with

access to the per CPU ring buffer via a cpuX file. But to save space, the

ring buffer will only allocate buffers for online CPUs, even though the

CPU array will be as big as the nr_cpu_ids.

With the addition of waking waiters on the ring buffer when closing the

file, the ring_buffer_wake_waiters() now needs to make sure that the

buffer is allocated (with the irq_work allocated with it) before trying to

wake waiters, as it will cause a NULL pointer dereference.

While debugging this, I added a NULL check for the buffer itself (which is

OK to do), and also NULL pointer checks against buffer->buffers (which is

not fine, and will WARN) as well as making sure the CPU number passed in

is within the nr_cpu_ids

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References