CVE-2022-49393

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

misc: fastrpc: fix list iterator in fastrpc_req_mem_unmap_impl

This is another instance of incorrect use of list iterator and

checking it for NULL.

The list iterator value 'map' will *always* be set and non-NULL

by list_for_each_entry(), so it is incorrect to assume that the

iterator value will be NULL if the list is empty (in this case, the

check 'if (!map) {' will always be false and never exit as expected).

To fix the bug, use a new variable 'iter' as the list iterator,

while use the original variable 'map' as a dedicated pointer to

point to the found element.

Without this patch, Kernel crashes with below trace:

Unable to handle kernel access to user memory outside uaccess routines

at virtual address 0000ffff7fb03750

...

Call trace:

fastrpc_map_create+0x70/0x290 [fastrpc]

fastrpc_req_mem_map+0xf0/0x2dc [fastrpc]

fastrpc_device_ioctl+0x138/0xc60 [fastrpc]

__arm64_sys_ioctl+0xa8/0xec

invoke_syscall+0x48/0x

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References