CVE-2022-50873

Vulnerability

Detail In the Linux kernel's vdpa/vp_vdpa driver, a bug was introduced in the vp_vdpa_remove() function. The code passes &vp_vdpa_mgtdev->mgtdev.id_table (a pointer to the pointer) as the argument to kfree, rather than the pointer itself. This results in the kernel attempting to free an incorrect memory location, leading to a kernel crash. The issue manifests as a kernel page fault at an invalid address, as shown in the crash dump.[1]

Exploit

Conditions The vulnerability can be triggered during the removal of a vdpa management device, which is part of normal driver unloading or device hot-unplug operations. An attacker with the ability to trigger such removal (e.g., by physically removing a device or via system admin commands) could cause a denial of service by crashing the system. No special privileges beyond those needed to manage devices are required, but the attack surface is limited to local access or to scenarios where a user can trigger device unbinding.[1]

Impact

A successful exploitation leads to a kernel panic and system crash, resulting in a denial of service. The crash trace shows the system entering a crash dump state, indicating complete loss of availability. There is no indication of memory corruption that could be leveraged for privilege escalation, making it a pure denial-of-service vulnerability.[1]

Mitigation

This vulnerability is fixed in the Linux kernel stable tree. The patch with commit ID ed843d6ed7310a27cf7c8ee0a82a482eed0cb4a6 corrects the kfree call to use the proper pointer. Users are advised to update their kernels to include this fix or apply the patch if manually building.[1]