CVE-2022-49052

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm: fix unexpected zeroed page mapping with zram swap

Two processes under CLONE_VM cloning, user process can be corrupted by

seeing zeroed page unexpectedly.

CPU A CPU B

do_swap_page do_swap_page

SWP_SYNCHRONOUS_IO path SWP_SYNCHRONOUS_IO path

swap_readpage valid data

swap_slot_free_notify

delete zram entry

swap_readpage zeroed(invalid) data

pte_lock

map the *zero data* to userspace

pte_unlock

pte_lock

if (!pte_same)

goto out_nomap;

pte_unlock

return and next refault will

read zeroed data

The swap_slot_free_notify is bogus for CLONE_VM case since it doesn't

increase the refcount of swap slot at copy_mm so it couldn't catch up

whether it's safe or not to discard data from backing device. In the

case, only the lock it co

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References