Executive brief
A vulnerability in the Linux kernel's block layer could allow a local user to cause a system crash or potentially execute unauthorized code. The issue occurs when the system reinitializes hardware queues for storage devices, such as NVMe drives, leading to a memory error known as a use-after-free. This could result in a complete system failure (kernel panic) or data corruption, impacting the reliability and security of the affected server or workstation.
Technical details
A use-after-free (UAF) vulnerability exists in the Linux kernel's blk-mq (Multi-Queue Block IO Queueing Mechanism) during the reinitialization of hardware queues. The root cause is a race condition between the hardware context's (hctx) 'run_work' function and the elevator switch process. While the queue is frozen during reinitialization, this only prevents new request allocations and does not stop existing hctx work from running. Consequently, the work thread may access an elevator pointer that is currently being torn down, leading to a NULL pointer dereference or UAF. Local attackers can exploit this to cause a denial of service (kernel panic) or potentially achieve privilege escalation. The fix involves using a quiesced elevator switch to ensure all pending work is stopped before the pointer is modified.
Affected products
- Linux Linux Kernel 4.19 to 5.19.17, 6.0 to 6.0.3
Timeline
- 2022-09-27: patched: Initial patch submitted by Keith Busch
- 2025-10-07: disclosed: CVE-2022-50552 published
References
- https://git.kernel.org/stable/c/0f90015383cd3f1128bebfbe7a97122d97808046
- https://git.kernel.org/stable/c/63a681bcc32a43528ce0f690569f7f48e59c3963
- https://git.kernel.org/stable/c/8237c01f1696bc53c470493bf1fe092a107648a6
- https://git.kernel.org/stable/c/9646443f28f33ec545ae303e613c3f476fad4dc1
- https://git.kernel.org/stable/c/c478b3b2900f1834cf9eda5bfef0d5696099505d