In the Linux kernel, the following vulnerability has been resolved:
s390: fix double free of GS and RI CBs on fork() failure
The pointers for guarded storage and runtime instrumentation control blocks are stored in the threadstruct of the associated task. These pointers are initially copied on fork() via archduptaskstruct() and then cleared via copythread() before fork() returns. If fork() happens to fail after the initial task dup and before copythread(), the newly allocated task and associated threadstruct memory are freed via freetask() -> archreleasetask_struct(). This results in a double free of the guarded storage and runtime info structs because the fields in the failed task still refer to memory associated with the source task.
This problem can manifest as a BUGON() in setfreepointer() (with CONFIGSLABFREELISTHARDENED enabled) or KASAN splat (if enabled) when running trinity syscall fuzz tests on s390x. To avoid this problem, clear the associated pointer fields in archduptaskstruct() immediately after the new task is copied. Note that the RI flag is still cleared in copy_thread() because it resides in thread stack memory and that is where stack info is copied.
[
{
"signature_version": "v1",
"digest": {
"function_hash": "306924909785283230314730787449958476770",
"length": 2223.0
},
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "copy_thread",
"file": "arch/s390/kernel/process.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@13cccafe0edcd03bf1c841de8ab8a1c8e34f77d9",
"id": "CVE-2022-49990-0cdd8292"
},
{
"signature_version": "v1",
"digest": {
"line_hashes": [
"73896972914831766717446053386732480331",
"169651564988570347722171360677814767626",
"284382818771967935660333843462617824172",
"160082238516916994317505742229120056170",
"247928470971715618417395154172059077762",
"219747821338265970049776779520894835034",
"100563734378950450932424594459325963774",
"51202379156925992169708991186130295720",
"62991173762914655017503962218736499701",
"147378922219007152590568418009299097254",
"273668588933425619428585792935446071818"
],
"threshold": 0.9
},
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "arch/s390/kernel/process.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cacd522e6652fbc2dc0cc6ae11c4e30782fef14b",
"id": "CVE-2022-49990-0e58cc18"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "287545325284837956774410252956643443120",
"length": 193.0
},
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "arch_dup_task_struct",
"file": "arch/s390/kernel/process.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fbdc482d43eda40a70de4b0155843d5472f6de62",
"id": "CVE-2022-49990-1a9f2131"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "287545325284837956774410252956643443120",
"length": 193.0
},
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "arch_dup_task_struct",
"file": "arch/s390/kernel/process.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cacd522e6652fbc2dc0cc6ae11c4e30782fef14b",
"id": "CVE-2022-49990-1b48b046"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "287545325284837956774410252956643443120",
"length": 193.0
},
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "arch_dup_task_struct",
"file": "arch/s390/kernel/process.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8195e065abf3df84eb0ad2987e76a40f21d1791c",
"id": "CVE-2022-49990-1d021d2c"
},
{
"signature_version": "v1",
"digest": {
"line_hashes": [
"73896972914831766717446053386732480331",
"169651564988570347722171360677814767626",
"284382818771967935660333843462617824172",
"131856196877488667710956409596379440644",
"247928470971715618417395154172059077762",
"219747821338265970049776779520894835034",
"100563734378950450932424594459325963774",
"51202379156925992169708991186130295720",
"62991173762914655017503962218736499701",
"147378922219007152590568418009299097254",
"273668588933425619428585792935446071818"
],
"threshold": 0.9
},
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "arch/s390/kernel/process.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@13cccafe0edcd03bf1c841de8ab8a1c8e34f77d9",
"id": "CVE-2022-49990-22b29168"
},
{
"signature_version": "v1",
"digest": {
"line_hashes": [
"73896972914831766717446053386732480331",
"169651564988570347722171360677814767626",
"284382818771967935660333843462617824172",
"26075983681172799102910781990728077430",
"247928470971715618417395154172059077762",
"219747821338265970049776779520894835034",
"100563734378950450932424594459325963774",
"51202379156925992169708991186130295720",
"62991173762914655017503962218736499701",
"147378922219007152590568418009299097254",
"273668588933425619428585792935446071818"
],
"threshold": 0.9
},
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "arch/s390/kernel/process.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@297ae7e87a87a001dd3dfeac1cb26a42fd929708",
"id": "CVE-2022-49990-232406de"
},
{
"signature_version": "v1",
"digest": {
"line_hashes": [
"73896972914831766717446053386732480331",
"169651564988570347722171360677814767626",
"284382818771967935660333843462617824172",
"160082238516916994317505742229120056170",
"247928470971715618417395154172059077762",
"219747821338265970049776779520894835034",
"100563734378950450932424594459325963774",
"51202379156925992169708991186130295720",
"62991173762914655017503962218736499701",
"147378922219007152590568418009299097254",
"273668588933425619428585792935446071818"
],
"threshold": 0.9
},
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "arch/s390/kernel/process.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@25a95303b9e513cd2978aacc385d06e6fec23d07",
"id": "CVE-2022-49990-288803d2"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "306924909785283230314730787449958476770",
"length": 2223.0
},
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "copy_thread",
"file": "arch/s390/kernel/process.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fbdc482d43eda40a70de4b0155843d5472f6de62",
"id": "CVE-2022-49990-5656ce80"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "287545325284837956774410252956643443120",
"length": 193.0
},
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "arch_dup_task_struct",
"file": "arch/s390/kernel/process.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@13cccafe0edcd03bf1c841de8ab8a1c8e34f77d9",
"id": "CVE-2022-49990-6fd992a6"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "287545325284837956774410252956643443120",
"length": 193.0
},
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "arch_dup_task_struct",
"file": "arch/s390/kernel/process.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@297ae7e87a87a001dd3dfeac1cb26a42fd929708",
"id": "CVE-2022-49990-813bf36e"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "324464361048806270792720194006409811937",
"length": 2084.0
},
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "copy_thread_tls",
"file": "arch/s390/kernel/process.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cacd522e6652fbc2dc0cc6ae11c4e30782fef14b",
"id": "CVE-2022-49990-85d5df8e"
},
{
"signature_version": "v1",
"digest": {
"line_hashes": [
"73896972914831766717446053386732480331",
"169651564988570347722171360677814767626",
"284382818771967935660333843462617824172",
"26075983681172799102910781990728077430",
"247928470971715618417395154172059077762",
"219747821338265970049776779520894835034",
"100563734378950450932424594459325963774",
"51202379156925992169708991186130295720",
"62991173762914655017503962218736499701",
"147378922219007152590568418009299097254",
"273668588933425619428585792935446071818"
],
"threshold": 0.9
},
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "arch/s390/kernel/process.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8195e065abf3df84eb0ad2987e76a40f21d1791c",
"id": "CVE-2022-49990-8827c5ef"
},
{
"signature_version": "v1",
"digest": {
"line_hashes": [
"73896972914831766717446053386732480331",
"169651564988570347722171360677814767626",
"284382818771967935660333843462617824172",
"131856196877488667710956409596379440644",
"247928470971715618417395154172059077762",
"219747821338265970049776779520894835034",
"100563734378950450932424594459325963774",
"51202379156925992169708991186130295720",
"62991173762914655017503962218736499701",
"147378922219007152590568418009299097254",
"273668588933425619428585792935446071818"
],
"threshold": 0.9
},
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "arch/s390/kernel/process.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fbdc482d43eda40a70de4b0155843d5472f6de62",
"id": "CVE-2022-49990-cf8629f4"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "337287896954832770893642008793866046759",
"length": 2049.0
},
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "copy_thread_tls",
"file": "arch/s390/kernel/process.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@25a95303b9e513cd2978aacc385d06e6fec23d07",
"id": "CVE-2022-49990-d8e99601"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "303472465006213874232916911636578412391",
"length": 2200.0
},
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "copy_thread",
"file": "arch/s390/kernel/process.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8195e065abf3df84eb0ad2987e76a40f21d1791c",
"id": "CVE-2022-49990-e2af92bb"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "287545325284837956774410252956643443120",
"length": 193.0
},
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "arch_dup_task_struct",
"file": "arch/s390/kernel/process.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@25a95303b9e513cd2978aacc385d06e6fec23d07",
"id": "CVE-2022-49990-e7dd27cd"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "324464361048806270792720194006409811937",
"length": 2084.0
},
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "copy_thread",
"file": "arch/s390/kernel/process.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@297ae7e87a87a001dd3dfeac1cb26a42fd929708",
"id": "CVE-2022-49990-f71d79dc"
}
]