CVE-2022-50744

Vulnerability

Description

CVE-2022-50744 is a vulnerability in the Linux kernel's lpfc (LightPulse Fibre Channel) SCSI driver. The issue manifests as a hard lockup when a user simultaneously performs I/O operations and reads the /sys/kernel/debug/lpfc/fnX/rx_monitor debugfs file. The root cause is that the spin_lock_bh used in the lpfc_rx_monitor_report function does not adequately protect against timer interrupts, leading to a deadlock scenario where the CPU spins indefinitely on a spin lock [1][2].

Exploitation and

Attack Surface

The vulnerability is triggered by a local user with access to the debugfs filesystem, typically requiring root privileges or appropriate capabilities to read the rx_monitor file. The attack surface is local, as the debugfs interface is only accessible from within the system. No authentication is needed beyond the ability to read the debugfs file, and the condition occurs during normal I/O activity combined with the debugfs read operation. The lockup is reproducible by running a cat command on the rx_monitor file while the system is under I/O load [1][2].

Impact

If exploited, the vulnerability is exploited, the system experiences a hard lockup, resulting in a kernel panic and denial of service. The call trace shows the CPU stuck in native_queued_spin_lock_slowpath while holding a spin lock, preventing any further progress. This effectively crashes the system, making it unavailable for all users and services. The impact is limited to availability, as the vulnerability does not allow for privilege escalation or data corruption [1][2].

Mitigation

The fix involves changing the spin lock from spin_lock_bh to spin_lock_irq_lock_irq in the lpfc_rx_monitor_report function, which properly disables interrupts and prevents the timer interrupt from causing a deadlock. The patch has been applied to the Linux kernel stable branches, and users are advised to update their kernels to include the fix. No workaround is available other than avoiding the debugfs read during I/O, but this is not a practical mitigation [1][2].