一、 漏洞 CVE-2022-49554 基础信息
漏洞标题
zsmalloc:修复异步zspage释放与页面迁移之间的竞争条件
来源：AIGC 神龙大模型
漏洞描述信息
在Linux内核中，已修复以下漏洞： zsmalloc：解决异步zspage释放与页面迁移之间的竞争条件 异步zspage释放工作程序试图锁定整个zspage页面列表，但没有防御页面迁移。由于尚未锁定的页面可以与lock_zspage()同时迁移到zspage页面列表之外，lock_zspage()可能会遭受几种致命的竞争条件。 它可能会锁定不再属于zspage的页面并不安全地解引用page_private()，它可能会不安全地解引用断裂的指针以指向下一个页面（由于存在数据竞争），并且可能会观察到一个虚假的NULL指针，指向下一个页面，因此无法锁定zspage的所有页面（由于单个页面迁移将重建整个页面列表，并且create_page_chain()会无条件地在该过程中将每个列表指针清零）。 通过在lock_zspage()中使用migrate_read_lock()来同步页面迁移，从而修复这些竞争条件。
来源：AIGC 神龙大模型
CVSS信息
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
来源：AIGC 神龙大模型
漏洞类别
使用共享资源的并发执行不恰当同步问题(竞争条件)
来源：AIGC 神龙大模型
漏洞标题
zsmalloc: fix races between asynchronous zspage free and page migration
来源：美国国家漏洞数据库 NVD
漏洞描述信息
In the Linux kernel, the following vulnerability has been resolved: zsmalloc: fix races between asynchronous zspage free and page migration The asynchronous zspage free worker tries to lock a zspage's entire page list without defending against page migration. Since pages which haven't yet been locked can concurrently migrate off the zspage page list while lock_zspage() churns away, lock_zspage() can suffer from a few different lethal races. It can lock a page which no longer belongs to the zspage and unsafely dereference page_private(), it can unsafely dereference a torn pointer to the next page (since there's a data race), and it can observe a spurious NULL pointer to the next page and thus not lock all of the zspage's pages (since a single page migration will reconstruct the entire page list, and create_page_chain() unconditionally zeroes out each list pointer in the process). Fix the races by using migrate_read_lock() in lock_zspage() to synchronize with page migration.
来源：美国国家漏洞数据库 NVD
CVSS信息
N/A
来源：美国国家漏洞数据库 NVD
漏洞类别
N/A
来源：美国国家漏洞数据库 NVD
二、漏洞 CVE-2022-49554 的公开POC
# POC 描述 源链接 神龙链接
三、漏洞 CVE-2022-49554 的情报信息

  • 标题： zsmalloc: fix races between asynchronous zspage free and page migration - kernel/git/stable/linux.git - Linux kernel stable tree -- 🔗来源链接

    标签：

    zsmalloc: fix races between asynchronous zspage free and page migration - kernel/git/stable/linux.git - Linux kernel stable tree

  • 标题： zsmalloc: fix races between asynchronous zspage free and page migration - kernel/git/stable/linux.git - Linux kernel stable tree -- 🔗来源链接

    标签：

    zsmalloc: fix races between asynchronous zspage free and page migration - kernel/git/stable/linux.git - Linux kernel stable tree

  • 标题： zsmalloc: fix races between asynchronous zspage free and page migration - kernel/git/stable/linux.git - Linux kernel stable tree -- 🔗来源链接

    标签：

    zsmalloc: fix races between asynchronous zspage free and page migration - kernel/git/stable/linux.git - Linux kernel stable tree

  • 标题： zsmalloc: fix races between asynchronous zspage free and page migration - kernel/git/stable/linux.git - Linux kernel stable tree -- 🔗来源链接

    标签：

    zsmalloc: fix races between asynchronous zspage free and page migration - kernel/git/stable/linux.git - Linux kernel stable tree

  • 标题： zsmalloc: fix races between asynchronous zspage free and page migration - kernel/git/stable/linux.git - Linux kernel stable tree -- 🔗来源链接

    标签：

    zsmalloc: fix races between asynchronous zspage free and page migration - kernel/git/stable/linux.git - Linux kernel stable tree

  • 标题： zsmalloc: fix races between asynchronous zspage free and page migration - kernel/git/stable/linux.git - Linux kernel stable tree -- 🔗来源链接

    标签：

    zsmalloc: fix races between asynchronous zspage free and page migration - kernel/git/stable/linux.git - Linux kernel stable tree

  • 标题： zsmalloc: fix races between asynchronous zspage free and page migration - kernel/git/stable/linux.git - Linux kernel stable tree -- 🔗来源链接

    标签：

    zsmalloc: fix races between asynchronous zspage free and page migration - kernel/git/stable/linux.git - Linux kernel stable tree

  • 标题： zsmalloc: fix races between asynchronous zspage free and page migration - kernel/git/stable/linux.git - Linux kernel stable tree -- 🔗来源链接

    标签：

    zsmalloc: fix races between asynchronous zspage free and page migration - kernel/git/stable/linux.git - Linux kernel stable tree
  • https://nvd.nist.gov/vuln/detail/CVE-2022-49554