CVE-2022-49990

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: s390: fix double free of GS and RI CBs on fork() failure The pointers for guarded storage and runtime instrumentation control blocks are stored in the thread_struct of the associated task. These pointers are initially copied on fork() via arch_dup_task_struct() and then cleared via copy_thread() before fork() returns. If fork() happens to fail after the initial task dup and before copy_thread(), the newly allocated task and associated thread_struct memory are freed via free_task() -> arch_release_task_struct(). This results...

Affected product and versions

Product

Linux Linux, linux kernel

Affected versions

>= 8d9047f8b967ce6181fd824ae922978e1b055cc0 < 25a95303b9e513cd2978aacc385d06e6fec23d07, >= 8d9047f8b967ce6181fd824ae922978e1b055cc0 < cacd522e6652fbc2dc0cc6ae11c4e30782fef14b, >= 8d9047f8b967ce6181fd824ae922978e1b055cc0 < 297ae7e87a87a001dd3dfeac1cb26a42fd929708, >= 8d9047f8b967ce6181fd824ae922978e1b055cc0 < 8195e065abf3df84eb0ad2987e76a40f21d1791c, >= 8d9047f8b967ce6181fd824ae922978e1b055cc0 < fbdc482d43eda40a70de4b0155843d5472f6de62, >= 8d9047f8b967ce6181fd824ae922978e1b055cc0 < 13cccafe0edcd03bf1c841de8ab8a1c8e34f77d9, >= 9e51ee1b76efc7b5e9404010793a39fde0e03cb7, >= 232b47b3c88af1da737cd7760f247c4ed58168cf, >= b8e212c599082896a180a18a0c9bd529526590be, >= 4.4.105 < 4.5, >= 4.9.68 < 4.10, >= 4.14.5 < 4.15, >= 4.15, >= 4.14.5 < 4.19.257, >= 4.20 < 5.4.212, >= 5.5 < 5.10.140, >= 5.11 < 5.15.64, >= 5.16 < 5.19.6, 6.0

Fixed versions

4.5, 4.10, 4.19.257, 5.4.212, 5.10.140, 5.15.64, 5.19.6

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-415