#VU111567 Improper locking in Linux kernel - CVE-2022-50202

Vulnerability identifier: #VU111567

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-50202

CWE-ID: CWE-667

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the snapshot_open(), snapshot_write() and snapshot_ioctl() functions in kernel/power/user.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's repository.

Vulnerable software versions

Linux kernel: 5.19, 5.19 rc1, 5.19 rc4, 5.19 rc5, 5.19 rc6, 5.19.1

---

External links
https://git.kernel.org/stable/c/003a456ae6f70bb97e436e02fc5105be577c1570
https://git.kernel.org/stable/c/2f0e18e0db42f4f8bc87d3d98333680065ceeff8
https://git.kernel.org/stable/c/3c48d3067eaf878642276f053575a5c642600a50
https://git.kernel.org/stable/c/5a283b59bce72c05c60e9f0fa92a28b5b850d8bb
https://git.kernel.org/stable/c/8386c414e27caba8501119948e9551e52b527f59
https://git.kernel.org/stable/c/8c90947e5f1801e6c7120021c6ea0f3ad6a4eb91
https://git.kernel.org/stable/c/b8e1ae9433d7bd95f2dcc044a7a6f20a4c40d258
https://git.kernel.org/stable/c/f7042cf9dd40733f387b7cac021e626c74b8856f
https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.19.2

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.