CVE-2022-50103
📋 TL;DR
A Linux kernel vulnerability in the cpuset scheduler can cause a kernel panic when attempting to attach tasks to cgroups with empty CPU masks. This affects systems using cgroup v2 with specific cpuset configurations, potentially leading to denial of service.
💻 Affected Systems
- Linux kernel
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Kernel panic leading to system crash and denial of service, requiring physical or remote reboot.
Likely Case
System instability or crash when cgroup operations are performed on cpusets with empty CPU masks.
If Mitigated
No impact if cgroup v2 is not used or cpusets are properly configured with non-empty CPU masks.
🎯 Exploit Status
Requires ability to manipulate cgroups/cpusets, typically needing appropriate privileges. Triggered during cgroup migration operations.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Multiple stable kernel versions with fixes (see git references in CVE description)
Vendor Advisory: https://git.kernel.org/stable/c/147f66d22f58712dce7ccdd6a1f6cb3ee8042df4
Restart Required: Yes
Instructions:
1. Identify your Linux kernel version. 2. Check if patches are available for your distribution. 3. Update kernel package via package manager (apt, yum, etc.). 4. Reboot system to load new kernel.
🔧 Temporary Workarounds
Avoid empty cpus_allowed masks
linuxEnsure cpusets have non-empty CPU masks configured in cgroup v2.
# Check cpuset configuration
cat /sys/fs/cgroup/cpuset.cpus.effective
# Set appropriate CPUs if empty
echo "0-3" > /sys/fs/cgroup/cpuset.cpus.effective
Use cgroup v1 instead of v2
linuxSwitch to cgroup v1 if possible, as vulnerability specifically affects v2 behavior.
# Add kernel boot parameter
Edit /etc/default/grub and add: systemd.unified_cgroup_hierarchy=0
# Update grub and reboot
update-grub
reboot
🧯 If You Can't Patch
- Restrict cgroup manipulation privileges to trusted users/processes only.
- Monitor system logs for cgroup-related errors or crashes and investigate cpuset configurations.
🔍 How to Verify
Check if Vulnerable:
Check kernel version and if cgroup v2 is active with potentially empty cpuset masks: uname -r && grep cgroup /proc/mounts | grep cgroup2Check Version:
uname -rVerify Fix Applied:
Verify kernel version is patched: uname -r should match or exceed patched versions from git references.📡 Detection & Monitoring
Log Indicators:
- Kernel panic messages mentioning dl_cpu_busy, cpuset_can_attach, or cgroup migration failures
- Out of bounds CPU access errors in kernel logs
Network Indicators:
- None - local vulnerability
SIEM Query:
source="kernel" AND ("dl_cpu_busy" OR "cpuset_can_attach" OR "cgroup_migrate" OR "page fault" AND "cpuset")🔗 References
- https://git.kernel.org/stable/c/147f66d22f58712dce7ccdd6a1f6cb3ee8042df4
- https://git.kernel.org/stable/c/336626564b58071b8980a4e6a31a8f5d92705d9b
- https://git.kernel.org/stable/c/357f3f0e522a6ce1ce4a571cb780d9861d53bec7
- https://git.kernel.org/stable/c/b6e8d40d43ae4dec00c8fea2593eeea3114b8f44
- https://git.kernel.org/stable/c/f56607b44c9896e51678a7e8cdd3a5479f4b4548
