Use-After-Free Vulnerability in Linux Kernel's Block Layer for NVMe Controllers

CVE-2022-50552

What is CVE-2022-50552?

A vulnerability exists in the Linux kernel's block layer, specifically in the handling of NVMe controllers. During the reinitialization of hardware queues, a race condition can occur where the hctx's run_work competes with the elevator switching process. This situation leads to a use-after-free condition. When this happens, the work may be assigned an elevator pointer that is in the process of being torn down, potentially resulting in kernel panics and NULL pointer dereferences. To mitigate this issue, the implementation now employs a quiesced elevator switch during queue reinitialization, ensuring that previous pointers are handled safely and locally.

References