#VU104814 Infinite loop in Linux kernel - CVE-2022-49607

Vulnerability identifier: #VU104814

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-49607

CWE-ID: CWE-835

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the mutex_lock_double(), perf_event_set_output(), ring_buffer_get() and mutex_unlock() functions in kernel/events/core.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/17f5417194136517ee9bbd6511249e5310e5617c
https://git.kernel.org/stable/c/3bbd868099287ff9027db59029b502fcfa2202a0
https://git.kernel.org/stable/c/43128b3eee337824158f34da6648163d2f2fb937
https://git.kernel.org/stable/c/68e3c69803dada336893640110cb87221bb01dcf
https://git.kernel.org/stable/c/98c3c8fd0d4c560e0f8335b79c407bbf7fc9462c
https://git.kernel.org/stable/c/a9391ff7a7c5f113d6f2bf6621d49110950de49c
https://git.kernel.org/stable/c/da3c256e2d0ebc87c7db0c605c9692b6f1722074
https://git.kernel.org/stable/c/f836f9ac95df15f1e0af4beb0ec20021e8c91998

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.