CVE-2022-50159

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

of: check previous kernel's ima-kexec-buffer against memory bounds

Presently ima_get_kexec_buffer() doesn't check if the previous kernel's

ima-kexec-buffer lies outside the addressable memory range. This can result

in a kernel panic if the new kernel is booted with 'mem=X' arg and the

ima-kexec-buffer was allocated beyond that range by the previous kernel.

The panic is usually of the form below:

$ sudo kexec --initrd initrd vmlinux --append='mem=16G'

<snip>

BUG: Unable to handle kernel data access on read at 0xc000c01fff7f0000

Faulting instruction address: 0xc000000000837974

Oops: Kernel access of bad area, sig: 11 [#1]

<snip>

NIP [c000000000837974] ima_restore_measurement_list+0x94/0x6c0

LR [c00000000083b55c] ima_load_kexec_buffer+0xac/0x160

Call Trace:

[c00000000371fa80] [c00000000083b55c] ima_load_kexec_buffer+0xac/0x160

[c00000000371fb00] [c0000000020512c4] ima_init+0x80/0x108

[c00000000371fb70] [c0000

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References