In the Linux kernel, the following vulnerability has been resolved:
sysctl: Fix data races in proc_douintvec().
A sysctl variable is accessed concurrently, and there is always a chance of data-race. So, all readers and writers need some basic protection to avoid load/store-tearing.
This patch changes procdouintvec() to use READONCE() and WRITEONCE() internally to fix data-races on the sysctl side. For now, procdouintvec() itself is tolerant to a data-race, but we still need to add annotations on the other subsystem's side.
[
{
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "kernel/sysctl.c",
"function": "do_proc_douintvec_conv"
},
"id": "CVE-2022-49641-8292bf74",
"digest": {
"function_hash": "331523190717984576238578449222133518993",
"length": 274.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@630c76850d554d7140232e71b5d1663e88cffb54"
},
{
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "kernel/sysctl.c",
"function": "do_proc_douintvec_conv"
},
"id": "CVE-2022-49641-9f8653b0",
"digest": {
"function_hash": "331523190717984576238578449222133518993",
"length": 274.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d5d54714e329f646bd7af4994fc427d88ee68936"
},
{
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "kernel/sysctl.c"
},
"id": "CVE-2022-49641-b2436a0c",
"digest": {
"line_hashes": [
"170957504483496595606183588254948981419",
"50640684296631342273974043284766215052",
"15720433995485624285662031519329573997",
"122478867490798043353881494018506796378",
"220667597552096840835821816903924817768",
"39047391199301237425225006606865448784"
],
"threshold": 0.9
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d5d54714e329f646bd7af4994fc427d88ee68936"
},
{
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "kernel/sysctl.c"
},
"id": "CVE-2022-49641-cbd37e45",
"digest": {
"line_hashes": [
"170957504483496595606183588254948981419",
"50640684296631342273974043284766215052",
"15720433995485624285662031519329573997",
"122478867490798043353881494018506796378",
"220667597552096840835821816903924817768",
"39047391199301237425225006606865448784"
],
"threshold": 0.9
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@630c76850d554d7140232e71b5d1663e88cffb54"
}
]