5.5

CVE-2022-49726

clocksource: hyper-v: unexport __init-annotated hv_init_clocksource()

In the Linux kernel, the following vulnerability has been resolved:

clocksource: hyper-v: unexport __init-annotated hv_init_clocksource()

EXPORT_SYMBOL and __init is a bad combination because the .init.text
section is freed up after the initialization. Hence, modules cannot
use symbols annotated __init. The access to a freed symbol may end up
with kernel panic.

modpost used to detect it, but it has been broken for a decade.

Recently, I fixed modpost so it started to warn it again, then this
showed up in linux-next builds.

There are two ways to fix it:

  - Remove __init
  - Remove EXPORT_SYMBOL

I chose the latter for this case because the only in-tree call-site,
arch/x86/kernel/cpu/mshyperv.c is never compiled as modular.
(CONFIG_HYPERVISOR_GUEST is boolean)
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 5.3 < 5.4.200
Linux ≫ Linux Kernel Version >= 5.5 < 5.10.124
Linux ≫ Linux Kernel Version >= 5.11 < 5.15.49
Linux ≫ Linux Kernel Version >= 5.16 < 5.18.6
Linux ≫ Linux Kernel Version5.19 Updaterc1
Linux ≫ Linux Kernel Version5.19 Updaterc2
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.27% 0.18
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-908 Use of Uninitialized Resource

The product uses or accesses a resource that has not been initialized.

https://git.kernel.org/stable/c/0414eab7c78f3518143d383e448d44fc573ac6d2
Patch
https://git.kernel.org/stable/c/245b993d8f6c4e25f19191edfbd8080b645e12b1
Patch
https://git.kernel.org/stable/c/937fcbb55a1e48a6422e87e8f49422c92265f102
Patch
https://git.kernel.org/stable/c/cff3a7ce6e81418b6e8bac941779bbf5d342d626
Patch
https://git.kernel.org/stable/c/db965e2757d95f695e606856418cd84003dd036d
Patch