CVE-2022-50657

Vulnerability

Overview

The vulnerability is a missing memcpy operation in the kasan_init function for the RISC-V architecture in the Linux kernel [1]. When kasan_populate is called during KASAN initialization, newly allocated page table entries (base_pud/base_p4d) must copy the content from kasan_early_shadow_{pud, p4d} structures. Without this memcpy, the shadow memory region is left unpopulated, leading to a page fault when the kernel attempts to read or write to the KASAN shadow area [1].

Exploitation and

Impact

This bug is triggered during early boot on RISC-V systems that enable KASAN (Kernel Address Sanitizer). The attacker does not need direct access to the system, but the vulnerability manifests as a kernel panic, causing a denial of service (DoS) [1]. The missing copy leaves page tables in an inconsistent state, so any access to the shadow region — part of normal KASAN operation — results in a fault that crashes the system [1].

Mitigation

The fix adds the required memcpy to ensure that the page table entries correctly reference the early shadow structures. The patch has been applied to the stable kernel tree and is identified by commit ff0f6becf3a6 [1]. Affected users should update to a kernel containing this commit to prevent boot panics when KASAN is enabled on RISC-V [1].