#VU104816 Infinite loop in Linux kernel - CVE-2022-49097

Vulnerability identifier: #VU104816

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-49097

CWE-ID: CWE-835

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the EXPORT_SYMBOL_GPL() function in fs/nfs/write.c, within the nfs_set_pgio_error(), nfs_generic_pgio() and nfs_pageio_alloc_mirrors() functions in fs/nfs/pagelist.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/0bae835b63c53f86cdc524f5962e39409585b22c
https://git.kernel.org/stable/c/1b3fa9a3c420c31e77b406ddc28f3a627100516c
https://git.kernel.org/stable/c/a6caeddd68977a1aaaf62fbd1955b41dd5c3c5d3
https://git.kernel.org/stable/c/c74e2f6ecc51bd08bb5b0335477dba954a50592e
https://git.kernel.org/stable/c/ea029e4ce760f786919d06ef52efa2e50ea92a5f

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.