#VU104660 Improper locking in Linux kernel - CVE-2022-49434

Vulnerability identifier: #VU104660

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-49434

CWE-ID: CWE-667

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the pci_reset_bus_function() and EXPORT_SYMBOL_GPL() functions in drivers/pci/pci.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/2cdd5284035322795b0964f899eefba254cfe483
https://git.kernel.org/stable/c/59ea6b3ae51df7cd6bfd84c9c0030609b9315622
https://git.kernel.org/stable/c/a91ee0e9fca9d7501286cfbced9b30a33e52740a
https://git.kernel.org/stable/c/aed6d4d519210c28817948f34c53b6e058e0456c
https://git.kernel.org/stable/c/c3c6dc1853b8bf3c718f96fd8480a6eb09ba4831
https://git.kernel.org/stable/c/c9a81f9ed6ae3554621d6a50220b1bc74b67d81e
https://git.kernel.org/stable/c/da9792920ab525b8a932aa9aeee34529ad7b83f7
https://git.kernel.org/stable/c/ea047f51172aa68841adef7f52d375002438b8f0
https://git.kernel.org/stable/c/eff3587b9c01439b738298475e555c028ac9f55e

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.