CVE-2022-49778

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-49778
In the Linux kernel, the following vulnerability has been resolved: arm64/mm: fix incorrect file_map_count for non-leaf pmd/pud The page table check trigger BUG_ON() unexpectedly when collapse hugepage: ------------[ cut here ]------------ kernel BUG at mm/page_table_check.c:82! Internal error: Oops - BUG: 00000000f2000800 [#1] SMP Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 6 PID: 68 Comm: khugepaged Not tainted 6.1.0-rc3+ #750 Hardware name: linux,dummy-virt (DT) pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : page_table_check_clear.isra.0+0x258/0x3f0 lr : page_table_check_clear.isra.0+0x240/0x3f0 [...] Call trace: page_table_check_clear.isra.0+0x258/0x3f0 __page_table_check_pmd_clear+0xbc/0x108 pmdp_collapse_flush+0xb0/0x160 collapse_huge_page+0xa08/0x1080 hpage_collapse_scan_pmd+0xf30/0x1590 khugepaged_scan_mm_slot.constprop.0+0x52c/0xac8 khugepaged+0x338/0x518 kthread+0x278/0x2f8 ret_from_fork+0x10/0x20 [...] Since pmd_user_accessible_page() doesn't check if a pmd is leaf, it decrease file_map_count for a non-leaf pmd comes from collapse_huge_page(). and so trigger BUG_ON() unexpectedly. Fix this problem by using pmd_leaf() insteal of pmd_present() in pmd_user_accessible_page(). Moreover, use pud_leaf() for pud_user_accessible_page() too.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/2d458046df634088611d44fd77f45465e833ef78 Patch
https://git.kernel.org/stable/c/5b47348fc0b18a78c96f8474cc90b7525ad1bbfe Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc5:*:*:*:*:*:*
History

07 Nov 2025, 18:40

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: arm64/mm: corrige el file_map_count incorrecto para pmd/pud que no es de hoja. La comprobación de la tabla de páginas se activa inesperadamente BUG_ON() cuando se colapsa hugepage: ------------[ cortar aquí ]------------ ¡ERROR del kernel en mm/page_table_check.c:82! Error interno: Ups - BUG: 00000000f2000800 [#1] SMP Volcando búfer ftrace: (búfer ftrace vacío) Módulos enlazados: CPU: 6 PID: 68 Comm: khugepaged No contaminado 6.1.0-rc3+ #750 Nombre del hardware: linux,dummy-virt (DT) pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : page_table_check_clear.isra.0+0x258/0x3f0 lr : page_table_check_clear.isra.0+0x240/0x3f0 [...] Rastreo de llamadas: page_table_check_clear.isra.0+0x258/0x3f0 __page_table_check_pmd_clear+0xbc/0x108 pmdp_collapse_flush+0xb0/0x160 collapse_huge_page+0xa08/0x1080 hpage_collapse_scan_pmd+0xf30/0x1590 khugepaged_scan_mm_slot.constprop.0+0x52c/0xac8 khugepaged+0x338/0x518 kthread+0x278/0x2f8 ret_from_fork+0x10/0x20 [...] Dado que pmd_user_accessible_page() no comprueba si un pmd es hoja, disminuye file_map_count para un pmd que no es hoja que proviene de colapso_huge_page() y, por lo tanto, activa BUG_ON() inesperadamente. Solucione este problema usando pmd_leaf() en lugar de pmd_present() en pmd_user_accessible_page(). Además, use pud_leaf() para pud_user_accessible_page().
References () https://git.kernel.org/stable/c/2d458046df634088611d44fd77f45465e833ef78 - () https://git.kernel.org/stable/c/2d458046df634088611d44fd77f45465e833ef78 - Patch
References () https://git.kernel.org/stable/c/5b47348fc0b18a78c96f8474cc90b7525ad1bbfe - () https://git.kernel.org/stable/c/5b47348fc0b18a78c96f8474cc90b7525ad1bbfe - Patch
CWE CWE-617
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
First Time Linux
Linux linux Kernel
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*

01 May 2025, 15:16

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-01 15:16

Updated : 2025-11-07 18:40

NVD link : CVE-2022-49778

Mitre link : CVE-2022-49778

CVE.ORG link : CVE-2022-49778

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-617

Reachable Assertion