CVE-2022-49371
📋 TL;DR
This CVE describes a deadlock vulnerability in the Linux kernel's device driver subsystem. When memory is low or work queue limits are reached, the __device_attach function can cause a double-acquisition deadlock (A-A deadlock) that could freeze the system. This affects all Linux systems using the vulnerable kernel versions.
💻 Affected Systems
- Linux kernel
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
System becomes completely unresponsive requiring hard reboot, potentially causing service disruption and data loss.
Likely Case
System hangs or becomes unstable when device probing occurs under memory pressure or high workload conditions.
If Mitigated
Minor performance impact during device attachment with no security compromise.
🎯 Exploit Status
This is a reliability/DoS issue rather than a traditional security vulnerability. Exploitation requires triggering specific race conditions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Multiple stable kernel versions with fixes referenced in CVE
Vendor Advisory: https://git.kernel.org/stable/c/34fdd9b7def9d2fcb71bb7b0bc4848dd7313767e
Restart Required: Yes
Instructions:
1. Update Linux kernel to patched version from your distribution's repositories. 2. Reboot system to load new kernel. 3. Verify kernel version matches patched release.
🔧 Temporary Workarounds
Disable async device probing
linuxPrevent the deadlock by disabling asynchronous device attachment
echo N > /sys/module/driver_probe_delay/parameters/probe_async
Increase memory limits
allReduce likelihood of triggering by ensuring adequate system memory
🧯 If You Can't Patch
- Monitor system memory usage and ensure adequate resources to avoid low memory conditions
- Implement system monitoring to detect and alert on system hangs or instability
🔍 How to Verify
Check if Vulnerable:
Check kernel version against affected ranges and verify if async device probing is enabledCheck Version:
uname -rVerify Fix Applied:
Verify kernel version is updated to patched version and system remains stable during device attachment📡 Detection & Monitoring
Log Indicators:
- System hang messages
- Kernel panic logs
- Device attachment failures in dmesg
Network Indicators:
- Sudden loss of connectivity from affected system
SIEM Query:
Search for kernel panic events or system hang alerts in system logs🔗 References
- https://git.kernel.org/stable/c/34fdd9b7def9d2fcb71bb7b0bc4848dd7313767e
- https://git.kernel.org/stable/c/36ee9ffca8ef56c302f2855c4a5fccf61c0c1ada
- https://git.kernel.org/stable/c/593b595332bd2d65e1a5c1ae7897996c157f5468
- https://git.kernel.org/stable/c/b232b02bf3c205b13a26dcec08e53baddd8e59ed
- https://git.kernel.org/stable/c/d53a227bfcd5160ce1b61d9954901968a20651e7
- https://git.kernel.org/stable/c/df6de52b80aa3b46f5ac804412355ffe2e1df93e
