CVE-2022-50373

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fs: dlm: fix race in lowcomms

This patch fixes a race between queue_work() in

_dlm_lowcomms_commit_msg() and srcu_read_unlock(). The queue_work() can

take the final reference of a dlm_msg and so msg->idx can contain

garbage which is signaled by the following warning:

[ 676.237050] ------------[ cut here ]------------

[ 676.237052] WARNING: CPU: 0 PID: 1060 at include/linux/srcu.h:189 dlm_lowcomms_commit_msg+0x41/0x50

[ 676.238945] Modules linked in: dlm_locktorture torture rpcsec_gss_krb5 intel_rapl_msr intel_rapl_common iTCO_wdt iTCO_vendor_support qxl kvm_intel drm_ttm_helper vmw_vsock_virtio_transport kvm vmw_vsock_virtio_transport_common ttm irqbypass crc32_pclmul joydev crc32c_intel serio_raw drm_kms_helper vsock virtio_scsi virtio_console virtio_balloon snd_pcm drm syscopyarea sysfillrect sysimgblt snd_timer fb_sys_fops i2c_i801 lpc_ich snd i2c_smbus soundcore pcspkr

[ 676.244227] CPU: 0 PID: 1060 Comm: lo

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References