CVE-2022-39188

Published: 2 September 2022

An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race condition (unmap_mapping_range versus munmap), a device driver can free a page while it still has stale TLB entries. This only occurs in situations with VM_PFNMAP VMAs.

From the Ubuntu Security Team

Jann Horn discovered a race condition existed in the Linux kernel when unmapping VMAs in certain situations, resulting in possible use-after-free vulnerabilities. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code.

Notes

for backports, see JannH's post to the stable list

for 5.4 kernels, two follow up commits are needed. in
upstream they are: b67fbebd4cf9 and b67fbebd4cf98, they were adjusted in
ubuntu kernel to match the needs.

Status