In the Linux kernel, the following vulnerability has been resolved:
s390: fix double free of GS and RI CBs on fork() failure
The pointers for guarded storage and runtime instrumentation control blocks are stored in the threadstruct of the associated task. These pointers are initially copied on fork() via archduptaskstruct() and then cleared via copythread() before fork() returns. If fork() happens to fail after the initial task dup and before copythread(), the newly allocated task and associated threadstruct memory are freed via freetask() -> archreleasetask_struct(). This results in a double free of the guarded storage and runtime info structs because the fields in the failed task still refer to memory associated with the source task.
This problem can manifest as a BUGON() in setfreepointer() (with CONFIGSLABFREELISTHARDENED enabled) or KASAN splat (if enabled) when running trinity syscall fuzz tests on s390x. To avoid this problem, clear the associated pointer fields in archduptaskstruct() immediately after the new task is copied. Note that the RI flag is still cleared in copy_thread() because it resides in thread stack memory and that is where stack info is copied.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49990.json"
}[
{
"target": {
"file": "arch/s390/kernel/process.c",
"function": "copy_thread"
},
"digest": {
"length": 2223.0,
"function_hash": "306924909785283230314730787449958476770"
},
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2022-49990-0cdd8292",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@13cccafe0edcd03bf1c841de8ab8a1c8e34f77d9"
},
{
"target": {
"file": "arch/s390/kernel/process.c"
},
"digest": {
"line_hashes": [
"73896972914831766717446053386732480331",
"169651564988570347722171360677814767626",
"284382818771967935660333843462617824172",
"160082238516916994317505742229120056170",
"247928470971715618417395154172059077762",
"219747821338265970049776779520894835034",
"100563734378950450932424594459325963774",
"51202379156925992169708991186130295720",
"62991173762914655017503962218736499701",
"147378922219007152590568418009299097254",
"273668588933425619428585792935446071818"
],
"threshold": 0.9
},
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2022-49990-0e58cc18",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cacd522e6652fbc2dc0cc6ae11c4e30782fef14b"
},
{
"target": {
"file": "arch/s390/kernel/process.c",
"function": "arch_dup_task_struct"
},
"digest": {
"length": 193.0,
"function_hash": "287545325284837956774410252956643443120"
},
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2022-49990-1a9f2131",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fbdc482d43eda40a70de4b0155843d5472f6de62"
},
{
"target": {
"file": "arch/s390/kernel/process.c",
"function": "arch_dup_task_struct"
},
"digest": {
"length": 193.0,
"function_hash": "287545325284837956774410252956643443120"
},
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2022-49990-1b48b046",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cacd522e6652fbc2dc0cc6ae11c4e30782fef14b"
},
{
"target": {
"file": "arch/s390/kernel/process.c",
"function": "arch_dup_task_struct"
},
"digest": {
"length": 193.0,
"function_hash": "287545325284837956774410252956643443120"
},
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2022-49990-1d021d2c",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8195e065abf3df84eb0ad2987e76a40f21d1791c"
},
{
"target": {
"file": "arch/s390/kernel/process.c"
},
"digest": {
"line_hashes": [
"73896972914831766717446053386732480331",
"169651564988570347722171360677814767626",
"284382818771967935660333843462617824172",
"131856196877488667710956409596379440644",
"247928470971715618417395154172059077762",
"219747821338265970049776779520894835034",
"100563734378950450932424594459325963774",
"51202379156925992169708991186130295720",
"62991173762914655017503962218736499701",
"147378922219007152590568418009299097254",
"273668588933425619428585792935446071818"
],
"threshold": 0.9
},
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2022-49990-22b29168",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@13cccafe0edcd03bf1c841de8ab8a1c8e34f77d9"
},
{
"target": {
"file": "arch/s390/kernel/process.c"
},
"digest": {
"line_hashes": [
"73896972914831766717446053386732480331",
"169651564988570347722171360677814767626",
"284382818771967935660333843462617824172",
"26075983681172799102910781990728077430",
"247928470971715618417395154172059077762",
"219747821338265970049776779520894835034",
"100563734378950450932424594459325963774",
"51202379156925992169708991186130295720",
"62991173762914655017503962218736499701",
"147378922219007152590568418009299097254",
"273668588933425619428585792935446071818"
],
"threshold": 0.9
},
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2022-49990-232406de",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@297ae7e87a87a001dd3dfeac1cb26a42fd929708"
},
{
"target": {
"file": "arch/s390/kernel/process.c"
},
"digest": {
"line_hashes": [
"73896972914831766717446053386732480331",
"169651564988570347722171360677814767626",
"284382818771967935660333843462617824172",
"160082238516916994317505742229120056170",
"247928470971715618417395154172059077762",
"219747821338265970049776779520894835034",
"100563734378950450932424594459325963774",
"51202379156925992169708991186130295720",
"62991173762914655017503962218736499701",
"147378922219007152590568418009299097254",
"273668588933425619428585792935446071818"
],
"threshold": 0.9
},
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2022-49990-288803d2",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@25a95303b9e513cd2978aacc385d06e6fec23d07"
},
{
"target": {
"file": "arch/s390/kernel/process.c",
"function": "copy_thread"
},
"digest": {
"length": 2223.0,
"function_hash": "306924909785283230314730787449958476770"
},
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2022-49990-5656ce80",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fbdc482d43eda40a70de4b0155843d5472f6de62"
},
{
"target": {
"file": "arch/s390/kernel/process.c",
"function": "arch_dup_task_struct"
},
"digest": {
"length": 193.0,
"function_hash": "287545325284837956774410252956643443120"
},
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2022-49990-6fd992a6",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@13cccafe0edcd03bf1c841de8ab8a1c8e34f77d9"
},
{
"target": {
"file": "arch/s390/kernel/process.c",
"function": "arch_dup_task_struct"
},
"digest": {
"length": 193.0,
"function_hash": "287545325284837956774410252956643443120"
},
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2022-49990-813bf36e",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@297ae7e87a87a001dd3dfeac1cb26a42fd929708"
},
{
"target": {
"file": "arch/s390/kernel/process.c",
"function": "copy_thread_tls"
},
"digest": {
"length": 2084.0,
"function_hash": "324464361048806270792720194006409811937"
},
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2022-49990-85d5df8e",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cacd522e6652fbc2dc0cc6ae11c4e30782fef14b"
},
{
"target": {
"file": "arch/s390/kernel/process.c"
},
"digest": {
"line_hashes": [
"73896972914831766717446053386732480331",
"169651564988570347722171360677814767626",
"284382818771967935660333843462617824172",
"26075983681172799102910781990728077430",
"247928470971715618417395154172059077762",
"219747821338265970049776779520894835034",
"100563734378950450932424594459325963774",
"51202379156925992169708991186130295720",
"62991173762914655017503962218736499701",
"147378922219007152590568418009299097254",
"273668588933425619428585792935446071818"
],
"threshold": 0.9
},
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2022-49990-8827c5ef",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8195e065abf3df84eb0ad2987e76a40f21d1791c"
},
{
"target": {
"file": "arch/s390/kernel/process.c"
},
"digest": {
"line_hashes": [
"73896972914831766717446053386732480331",
"169651564988570347722171360677814767626",
"284382818771967935660333843462617824172",
"131856196877488667710956409596379440644",
"247928470971715618417395154172059077762",
"219747821338265970049776779520894835034",
"100563734378950450932424594459325963774",
"51202379156925992169708991186130295720",
"62991173762914655017503962218736499701",
"147378922219007152590568418009299097254",
"273668588933425619428585792935446071818"
],
"threshold": 0.9
},
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2022-49990-cf8629f4",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fbdc482d43eda40a70de4b0155843d5472f6de62"
},
{
"target": {
"file": "arch/s390/kernel/process.c",
"function": "copy_thread_tls"
},
"digest": {
"length": 2049.0,
"function_hash": "337287896954832770893642008793866046759"
},
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2022-49990-d8e99601",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@25a95303b9e513cd2978aacc385d06e6fec23d07"
},
{
"target": {
"file": "arch/s390/kernel/process.c",
"function": "copy_thread"
},
"digest": {
"length": 2200.0,
"function_hash": "303472465006213874232916911636578412391"
},
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2022-49990-e2af92bb",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8195e065abf3df84eb0ad2987e76a40f21d1791c"
},
{
"target": {
"file": "arch/s390/kernel/process.c",
"function": "arch_dup_task_struct"
},
"digest": {
"length": 193.0,
"function_hash": "287545325284837956774410252956643443120"
},
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2022-49990-e7dd27cd",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@25a95303b9e513cd2978aacc385d06e6fec23d07"
},
{
"target": {
"file": "arch/s390/kernel/process.c",
"function": "copy_thread"
},
"digest": {
"length": 2084.0,
"function_hash": "324464361048806270792720194006409811937"
},
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2022-49990-f71d79dc",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@297ae7e87a87a001dd3dfeac1cb26a42fd929708"
}
]
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-49990.json"