CVE-2022-50091

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

locking/csd_lock: Change csdlock_debug from early_param to __setup

The csdlock_debug kernel-boot parameter is parsed by the

early_param() function csdlock_debug(). If set, csdlock_debug()

invokes static_branch_enable() to enable csd_lock_wait feature, which

triggers a panic on arm64 for kernels built with CONFIG_SPARSEMEM=y and

CONFIG_SPARSEMEM_VMEMMAP=n.

With CONFIG_SPARSEMEM_VMEMMAP=n, __nr_to_section is called in

static_key_enable() and returns NULL, resulting in a NULL dereference

because mem_section is initialized only later in sparse_init().

This is also a problem for powerpc because early_param() functions

are invoked earlier than jump_label_init(), also resulting in

static_key_enable() failures. These failures cause the warning "static

key 'xxx' used before call to jump_label_init()".

Thus, early_param is too early for csd_lock_wait to run

static_branch_enable(), so changes it to __setup to fix these.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References