CVE-2022-49703

Summary

CVE-2022-49703 is a vulnerability affecting the Linux kernel's IBM PowerVM Virtual I/O Controller (ibmvfc) driver. The issue lies in the allocation of queue structures for SCSI commands in the ibmvfc_register_scsi_channel function. Prior to registration, the back pointer from a queue to the vhost adapter isn't set, making it vulnerable to dereferencing a garbage value upon interrupt registration. This can lead to a kernel NULL pointer dereference and potential exploitation, as evidenced by the stack trace showing a user page read attempt and crash. The vulnerability was addressed with the fixes in the ibmvfc_init_sub_crqs, ibmvfc_reset_crq, and ibmvfc_init_crq functions.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.