CVE-2022-50494
Description
A null pointer dereference flaw was found in the Linux kernel thermal/intel_powerclamp driver. When CPU 0 is offline and the intel_powerclamp driver attempts to inject idle cycles, the code incorrectly calls smp_processor_id() preemptively, which triggers a kernel BUG. This occurs because the function checks for the control CPU without holding the proper lock. A local user could use this flaw to crash the system, causing a denial of service
Statement
The issue is limited to systems where intel_powerclamp is enabled and configured to inject idle on non-boot CPUs. The crash occurs because smp_processor_id() is used without disabling preemption, resulting in an invalid access when CPU 0 is offline. The upstream patch replaces this with get_cpu() to ensure the CPU context is properly pinned and to prevent preemptible code from calling smp_processor_id().
Mitigation
To mitigate this issue, prevent the intel_powerclamp module from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | 5.5 | N/A |
| Attack Vector | Local | Local | N/A |
| Attack Complexity | Low | Low | N/A |
| Privileges Required | Low | Low | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | None | None | N/A |
| Integrity Impact | None | None | N/A |
| Availability Impact | High | High | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
