CVE-2022-50630

Root

Cause

In the Linux kernel's hugetlb fault handling path, the function hugetlb_handle_userfault() temporarily drops the VMA lock (vma_lock) and the hugetlb fault mutex before invoking handle_userfault(). After the userfault is handled, the code reacquires the VMA lock. However, during the window when the lock is dropped, a concurrent thread can call `munmap the VMA, freeing the underlying memory. When the lock is reacquired, the kernel accesses freed memory, leading to a use-after-free (UAF) condition [1][2].

Exploitation

An attacker must be able to trigger a hugetlb page fault that results in a userfault, and simultaneously have a thread that can unmap the same VMA (e.g., via munmap). The race window exists between the unlock of vma_lock in hugetlb_handle_userfault() and its reacquisition after handle_userfault() returns. No special privileges are required beyond the ability to map hugetlb pages and trigger userfaults, which is available to unprivileged users in many configurations.

Impact

Successful exploitation of this UAF can allow an attacker to corrupt kernel memory, potentially leading to a denial of service (system crash) or, in more severe cases, arbitrary code execution with kernel privileges. The vulnerability is rated with a CVSS score of 7.8 (High) due to the high impact on confidentiality, integrity, and availability.

Mitigation

The fix, committed as 45c33966759e and 0db2efb3bff8 in the Linux kernel stable tree, removes the unnecessary lock/unlock cycle in hugetlb_handle_userfault(), ensuring the VMA lock is not dropped during the userfault handling. Users should apply the latest kernel updates from their distribution to remediate this vulnerability.