CVE-2022-49767

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

9p/trans_fd: always use O_NONBLOCK read/write

syzbot is reporting hung task at p9_fd_close() [1], for p9_mux_poll_stop()

from p9_conn_destroy() from p9_fd_close() is failing to interrupt already

started kernel_read() from p9_fd_read() from p9_read_work() and/or

kernel_write() from p9_fd_write() from p9_write_work() requests.

Since p9_socket_open() sets O_NONBLOCK flag, p9_mux_poll_stop() does not

need to interrupt kernel_read()/kernel_write(). However, since p9_fd_open()

does not set O_NONBLOCK flag, but pipe blocks unless signal is pending,

p9_mux_poll_stop() needs to interrupt kernel_read()/kernel_write() when

the file descriptor refers to a pipe. In other words, pipe file descriptor

needs to be handled as if socket file descriptor.

We somehow need to interrupt kernel_read()/kernel_write() on pipes.

A minimal change, which this patch is doing, is to set O_NONBLOCK flag

from p9_fd_open(), for O_NONBLOCK flag do

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References