CVE-2022-50510
MEDIUMCVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
3Description
In the Linux kernel, the following vulnerability has been resolved: perf/smmuv3: Fix hotplug callback leak in arm_smmu_pmu_init() arm_smmu_pmu_init() won't remove the callback added by cpuhp_setup_state_multi() when platform_driver_register() failed. Remove the callback by cpuhp_remove_multi_state() in fail path. Similar to the handling of arm_ccn_init() in commit 26242b330093 ("bus: arm-ccn: Prevent hotplug callback leak")
Analysis
A resource cleanup vulnerability exists in the Linux kernel's ARM SMMUv3 Performance Monitoring Unit (PMU) initialization code where a CPU hotplug callback registered via cpuhp_setup_state_multi() is not properly removed if platform_driver_register() fails, leading to a use-after-free condition. This affects Linux kernel versions across multiple stable branches and can be exploited by local attackers with limited privileges to trigger a denial of service through kernel panic or memory corruption. The vulnerability has a patch available from multiple kernel branches, with an EPSS score of 0.01% indicating low real-world exploitation probability despite the moderate CVSS 5.5 score.
Technical Context
The vulnerability resides in the perf/smmuv3 subsystem of the Linux kernel, specifically in the arm_smmu_pmu_init() function responsible for initializing performance monitoring capabilities for ARM System Memory Management Unit version 3 devices. The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime), a resource management failure where a system resource (CPU hotplug callback state) is allocated but never deallocated in error paths. The affected component is part of the ARM SMMU PMU driver (cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*), which provides performance monitoring for virtualization and memory management operations. When cpuhp_setup_state_multi() successfully registers a hotplug callback but platform_driver_register() subsequently fails, the callback remains active in kernel memory. The fix, similar to commit 26242b330093 in the ARM CCN driver, requires explicitly calling cpuhp_remove_multi_state() in the error handling path to properly clean up the registered callback state machine.
Affected Products
The Linux kernel across multiple versions and stable branches is affected, as indicated by the CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*. Patches have been released in the stable kernel branches as evidenced by six commits: 359286f886feef38536eaa7e673dc3440f03b0a1, 582babe17ea878ec1d76f30e03f3a6ce6e30eb91, 6f2d566b46436a50a80d6445e82879686b89588c, b131304fe722853cf26e55c4fa21fc58a36e7f21, d69bdb61d577297d3851fc9f6403574bf73ef41f, and f245ca9a0fe7f794a8187ad803d5e2ced5a11cb2 in the kernel.org stable repository. The specific affected versions are Linux kernel versions that include the vulnerable arm_smmu_pmu_init() code prior to the patch integration, which likely spans multiple kernel series (5.x and 6.x branches based on typical stable kernel patching). Systems running ARM64 architecture with SMMU hardware support and the perf subsystem enabled are at highest risk.
Remediation
Upgrade to a patched Linux kernel version that includes one of the six commits referenced in the stable kernel repository at https://git.kernel.org/stable/. Users should identify their current kernel version and update to the next stable release that includes the arm_smmu_pmu_init() hotplug callback cleanup fix. For systems that cannot immediately patch, the vulnerability impact is minimized since exploitation requires either intentional triggering of platform driver registration failure or local code execution capability. Ensure systems are kept current with stable kernel updates from your distribution (e.g., kernel-lts packages for RHEL/CentOS, linux-image-generic for Ubuntu), and verify patch status using 'uname -r' post-update. For production ARM-based systems running ARM SMMU virtualization, prioritize kernel patching as part of your regular maintenance window. No runtime workarounds or configuration changes can mitigate this vulnerability; kernel patching is the only remediation.
Priority Score
Vendor Status
Share
External POC / Exploit Code
Leaving vuln.today