CVE-2022-50174

MEDIUM EPSS 4.5%
Published Jun 18, 20251y ago · Modified Jun 17, 20261w ago
5.5 CVSS 3.1
Medium
Find Similar
Published Jun 18, 2025 1y ago
Last Modified Jun 17, 2026 1w ago

Description

In the Linux kernel, the following vulnerability has been resolved: net: hinic: avoid kernel hung in hinic_get_stats64() When using hinic device as a bond slave device, and reading device stats of master bond device, the kernel may hung. The kernel panic calltrace as follows: Kernel panic - not syncing: softlockup: hung tasks Call trace: native_queued_spin_lock_slowpath+0x1ec/0x31c dev_get_stats+0x60/0xcc dev_seq_printf_stats+0x40/0x120 dev_seq_show+0x1c/0x40 seq_read_iter+0x3c8/0x4dc seq_read+0xe0/0x130 proc_reg_read+0xa8/0xe0 vfs_read+0xb0/0x1d4 ksys_read+0x70/0xfc __arm64_sys_read+0x20/0x30 el0_svc_common+0x88/0x234 do_el0_svc+0x2c/0x90 el0_svc+0x1c/0x30 el0_sync_handler+0xa8/0xb0 el0_sync+0x148/0x180 And the calltrace of task that actually caused kernel hungs as follows: __switch_to+124 __schedule+548 schedule+72 schedule_timeout+348 __down_common+188 __down+24 down+104 hinic_get_stats64+44 [hinic] dev_get_stats+92 bond_get_stats+172 [bonding] dev_get_stats+92 dev_seq_printf_stats+60 dev_seq_show+24 seq_read_iter+964 seq_read+220 proc_reg_read+164 vfs_read+172 ksys_read+108 __arm64_sys_read+28 el0_svc_common+132 do_el0_svc+40 el0_svc+24 el0_sync_handler+164 el0_sync+324 When getting device stats from bond, kernel will call bond_get_stats(). It first holds the spinlock bond->stats_lock, and then call hinic_get_stats64() to collect hinic device's stats. However, hinic_get_stats64() calls `down(&nic_dev->mgmt_lock)` to protect its critical section, which may schedule current task out. And if system is under high pressure, the task cannot be woken up immediately, which eventually triggers kernel hung panic. Since previous patch has replaced hinic_dev.tx_stats/rx_stats with local variable in hinic_get_stats64(), there is nothing need to be protected by lock, so just removing down()/up() is ok.

CVSS Details

Base Score
5.5
Exploitability
1.8
Impact
3.6
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
4.5% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-667

Affected Products 4

VendorProductVersionRange
linuxlinux_kernel*≥4.14  –  <5.10.137
linuxlinux_kernel*≥5.11  –  <5.15.61
linuxlinux_kernel*≥5.16  –  <5.18.18
linuxlinux_kernel*≥5.19  –  <5.19.2

References 5

  • git.kernel.org https://git.kernel.org/stable/c/3ba59bbe4f306bb6ee15753db0a40564c0eb7909
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/693f31dc91568e61047fd2980a8235e856cd9ce8
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/98f9fcdee35add80505b6c73f72de5f750d5c03c
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/e74f3097a9c713ce855cda07713393bcc23a005d
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/fced5bce712122654ec8a20356342698cce104d2
    Patch

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/3ba59bbe4f306bb6ee15753db0a40564c0eb7909
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/693f31dc91568e61047fd2980a8235e856cd9ce8
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/98f9fcdee35add80505b6c73f72de5f750d5c03c
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/e74f3097a9c713ce855cda07713393bcc23a005d
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/fced5bce712122654ec8a20356342698cce104d2
    Patch