CVE-2022-50553

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tracing/hist: Fix out-of-bound write on 'action_data.var_ref_idx'

When generate a synthetic event with many params and then create a trace

action for it [1], kernel panic happened [2].

It is because that in trace_action_create() 'data->n_params' is up to

SYNTH_FIELDS_MAX (current value is 64), and array 'data->var_ref_idx'

keeps indices into array 'hist_data->var_refs' for each synthetic event

param, but the length of 'data->var_ref_idx' is TRACING_MAP_VARS_MAX

(current value is 16), so out-of-bound write happened when 'data->n_params'

more than 16. In this case, 'data->match_data.event' is overwritten and

eventually cause the panic.

To solve the issue, adjust the length of 'data->var_ref_idx' to be

SYNTH_FIELDS_MAX and add sanity checks to avoid out-of-bound write.

[1]

# cd /sys/kernel/tracing/

# echo "my_synth_event int v1; int v2; int v3; int v4; int v5; int v6;\

int v7; int v8; int v9; int v10; int v11; int

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References