Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2022-49402: Linux kernel may crash when ftrace registration fails
CVE-2022-49402 · published 1 year ago
Summary
The Linux kernel versions used in several Canonical cloud images have a bug that can cause a system crash during a specific tracing setup. This occurs when the kernel tries to register a direct function for tracing and encounters an error, leading to a protection fault. Update to the latest kernel releases from your distribution to apply the fix and avoid potential crashes.
What to do
- Update canonical linux-gke to version 5.15.0-1015.18.
- Update canonical linux-gkeop to version 5.15.0-1002.4.
- Update canonical linux-ibm to version 5.15.0-1013.15.
- Update canonical linux-intel-iotg to version 5.15.0-1015.20.
- Update canonical linux-kvm to version 5.15.0-1017.21.
- Update canonical linux-lowlatency to version 5.15.0-47.53.
- Update canonical linux-aws-5.15 to version 5.15.0-1019.23~20.04.1.
- Update canonical linux-azure-5.15 to version 5.15.0-1019.24~20.04.1.
- Update canonical linux-gcp-5.15 to version 5.15.0-1017.23~20.04.2.
- Update canonical linux-hwe-5.15 to version 5.15.0-48.54~20.04.1.
- Update canonical linux-intel-iotg-5.15 to version 5.15.0-1015.20~20.04.2.
- Update canonical linux-lowlatency-hwe-5.15 to version 5.15.0-48.54~20.04.1.
- Update canonical linux-oracle-5.15 to version 5.15.0-1017.22~20.04.1.
- Update canonical linux-riscv-5.15 to version 5.15.0-1018.21~20.04.1.
- Update canonical linux to version 5.15.0-47.51.
- Update canonical linux-aws to version 5.15.0-1019.23.
- Update canonical linux-azure to version 5.15.0-1019.24.
- Update canonical linux-gcp to version 5.15.0-1017.23.
- Update canonical linux-nvidia to version 5.15.0-1007.7.
- Update canonical linux-oracle to version 5.15.0-1017.22.
- Update canonical linux-raspi to version 5.15.0-1014.16.
- Update canonical linux-realtime to version 5.15.0-1020.20.
- Update debian linux to version 5.18.5-1.
- Update linux kernel to version 5.18.3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | linux | linux_kernel |
>= 5.5, < 5.10.121 >= 5.11, < 5.15.46 >= 5.16, < 5.17.14 >= 5.18, < 5.18.3 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Ubuntu:22.04:LTS | canonical | linux-gcp-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-gcp-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-gcp-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-gke |
< 5.15.0-1015.18 Fix: upgrade to 5.15.0-1015.18
|
| Ubuntu:22.04:LTS | canonical | linux-gkeop |
< 5.15.0-1002.4 Fix: upgrade to 5.15.0-1002.4
|
| Ubuntu:22.04:LTS | canonical | linux-hwe-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-hwe-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-hwe-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-ibm |
< 5.15.0-1013.15 Fix: upgrade to 5.15.0-1013.15
|
| Ubuntu:22.04:LTS | canonical | linux-intel-iot-realtime | All versions |
| Ubuntu:22.04:LTS | canonical | linux-intel-iotg |
< 5.15.0-1015.20 Fix: upgrade to 5.15.0-1015.20
|
| Ubuntu:22.04:LTS | canonical | linux-kvm |
< 5.15.0-1017.21 Fix: upgrade to 5.15.0-1017.21
|
| Ubuntu:22.04:LTS | canonical | linux-lowlatency |
< 5.15.0-47.53 Fix: upgrade to 5.15.0-47.53
|
| Ubuntu:22.04:LTS | canonical | linux-lowlatency-hwe-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-lowlatency-hwe-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-lowlatency-hwe-6.5 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-oem | All versions |
| Ubuntu:16.04:LTS | canonical | linux-hwe-edge | All versions |
| Ubuntu:18.04:LTS | canonical | linux-aws-5.0 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-aws-5.3 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-azure | All versions |
| Ubuntu:18.04:LTS | canonical | linux-azure-5.3 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-azure-edge | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gcp | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gcp-5.3 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gke-4.15 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gke-5.4 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gkeop-5.4 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-hwe | All versions |
| Ubuntu:18.04:LTS | canonical | linux-hwe-edge | All versions |
| Ubuntu:18.04:LTS | canonical | linux-oracle-5.0 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-oracle-5.3 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-aws-5.15 |
< 5.15.0-1019.23~20.04.1 Fix: upgrade to 5.15.0-1019.23~20.04.1
|
| Ubuntu:20.04:LTS | canonical | linux-azure-5.15 |
< 5.15.0-1019.24~20.04.1 Fix: upgrade to 5.15.0-1019.24~20.04.1
|
| Ubuntu:20.04:LTS | canonical | linux-gcp-5.15 |
< 5.15.0-1017.23~20.04.2 Fix: upgrade to 5.15.0-1017.23~20.04.2
|
| Ubuntu:20.04:LTS | canonical | linux-hwe-5.15 |
< 5.15.0-48.54~20.04.1 Fix: upgrade to 5.15.0-48.54~20.04.1
|
| Ubuntu:20.04:LTS | canonical | linux-intel-iotg-5.15 |
< 5.15.0-1015.20~20.04.2 Fix: upgrade to 5.15.0-1015.20~20.04.2
|
| Ubuntu:20.04:LTS | canonical | linux-lowlatency-hwe-5.15 |
< 5.15.0-48.54~20.04.1 Fix: upgrade to 5.15.0-48.54~20.04.1
|
| Ubuntu:20.04:LTS | canonical | linux-oracle-5.15 |
< 5.15.0-1017.22~20.04.1 Fix: upgrade to 5.15.0-1017.22~20.04.1
|
| Ubuntu:20.04:LTS | canonical | linux-riscv-5.15 |
< 5.15.0-1018.21~20.04.1 Fix: upgrade to 5.15.0-1018.21~20.04.1
|
| Ubuntu:20.04:LTS | canonical | linux-aws-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-aws-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-aws-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-fde | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gcp-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gcp-5.13 | All versions |
Showing 50 of 104. Show the rest
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:20.04:LTS | canonical | linux-gcp-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gke | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gke-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gkeop | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gkeop-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-hwe-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-hwe-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-hwe-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-intel-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.10 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.14 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.6 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oracle-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oracle-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oracle-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-raspi2 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-riscv | All versions |
| Ubuntu:20.04:LTS | canonical | linux-riscv-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-riscv-5.8 | All versions |
| Ubuntu:22.04:LTS | canonical | linux |
< 5.15.0-47.51 Fix: upgrade to 5.15.0-47.51
|
| Ubuntu:22.04:LTS | canonical | linux-allwinner-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-aws |
< 5.15.0-1019.23 Fix: upgrade to 5.15.0-1019.23
|
| Ubuntu:22.04:LTS | canonical | linux-aws-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-aws-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-aws-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure |
< 5.15.0-1019.24 Fix: upgrade to 5.15.0-1019.24
|
| Ubuntu:22.04:LTS | canonical | linux-azure-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-fde-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-fde-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-gcp |
< 5.15.0-1017.23 Fix: upgrade to 5.15.0-1017.23
|
| Ubuntu:22.04:LTS | canonical | linux-nvidia |
< 5.15.0-1007.7 Fix: upgrade to 5.15.0-1007.7
|
| Ubuntu:22.04:LTS | canonical | linux-nvidia-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-nvidia-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oem-5.17 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oem-6.0 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oem-6.1 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oem-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oracle |
< 5.15.0-1017.22 Fix: upgrade to 5.15.0-1017.22
|
| Ubuntu:22.04:LTS | canonical | linux-oracle-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-raspi |
< 5.15.0-1014.16 Fix: upgrade to 5.15.0-1014.16
|
| Ubuntu:22.04:LTS | canonical | linux-realtime | All versions |
| Ubuntu:22.04:LTS | canonical | linux-riscv | All versions |
| Ubuntu:22.04:LTS | canonical | linux-riscv-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-riscv-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-starfive-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-starfive-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-starfive-6.5 | All versions |
| Ubuntu:Pro:Realtime:22.04:LTS | canonical | linux-realtime |
< 5.15.0-1020.20 Fix: upgrade to 5.15.0-1020.20
|
| Ubuntu:24.04:LTS | canonical | linux-raspi-realtime | All versions |
| Debian:12 | debian | linux |
< 5.18.5-1 Fix: upgrade to 5.18.5-1
|
| Linux | linux | kernel |
>= 5.18.0, < 5.18.3 Fix: upgrade to 5.18.3
|
Original advisory text
ftrace: Clean up hash direct_functions on register failures
In the Linux kernel, the following vulnerability has been resolved: ftrace: Clean up hash direct_functions on register failures We see the following GPF when register_ftrace_direct fails: [ ] general protection fault, probably for non-canonical address \ 0x200000000000010: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC PTI [...] [ ] RIP: 0010:ftrace_find_rec_direct+0x53/0x70 [ ] Code: 48 c1 e0 03 48 03 42 08 48 8b 10 31 c0 48 85 d2 74 [...] [ ] RSP: 0018:ffffc9000138bc10 EFLAGS: 00010206 [ ] RAX: 0000000000000000 RBX: ffffffff813e0df0 RCX: 000000000000003b [ ] RDX: 0200000000000000 RSI: 000000000000000c RDI: ffffffff813e0df0 [ ] RBP: ffffffffa00a3000 R08: ffffffff81180ce0 R09: 0000000000000001 [ ] R10: ffffc9000138bc18 R11: 0000000000000001 R12: ffffffff813e0df0 [ ] R13: ffffffff813e0df0 R14: ffff888171b56400 R15: 0000000000000000 [ ] FS: 00007fa9420c7780(0000) GS:ffff888ff6a00000(0000) knlGS:000000000 [ ] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ ] CR2: 000000000770d000 CR3: 0000000107d50003 CR4: 0000000000370ee0 [ ] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ ] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ ] Call Trace: [ ] <TASK> [ ] register_ftrace_direct+0x54/0x290 [ ] ? render_sigset_t+0xa0/0xa0 [ ] bpf_trampoline_update+0x3f5/0x4a0 [ ] ? 0xffffffffa00a3000 [ ] bpf_trampoline_link_prog+0xa9/0x140 [ ] bpf_tracing_prog_attach+0x1dc/0x450 [ ] bpf_raw_tracepoint_open+0x9a/0x1e0 [ ] ? find_held_lock+0x2d/0x90 [ ] ? lock_release+0x150/0x430 [ ] __sys_bpf+0xbd6/0x2700 [ ] ? lock_is_held_type+0xd8/0x130 [ ] __x64_sys_bpf+0x1c/0x20 [ ] do_syscall_64+0x3a/0x80 [ ] entry_SYSCALL_64_after_hwframe+0x44/0xae [ ] RIP: 0033:0x7fa9421defa9 [ ] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 9 f8 [...] [ ] RSP: 002b:00007ffed743bd78 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ ] RAX: ffffffffffffffda RBX: 00000000069d2480 RCX: 00007fa9421defa9 [ ] RDX: 0000000000000078 RSI: 00007ffed743bd80 RDI: 0000000000000011 [ ] RBP: 00007ffed743be00 R08: 0000000000bb7270 R09: 0000000000000000 [ ] R10: 00000000069da210 R11: 0000000000000246 R12: 0000000000000001 [ ] R13: 00007ffed743c4b0 R14: 00000000069d2480 R15: 0000000000000001 [ ] </TASK> [ ] Modules linked in: klp_vm(OK) [ ] ---[ end trace 0000000000000000 ]--- One way to trigger this is: 1. load a livepatch that patches kernel function xxx; 2. run bpftrace -e 'kfunc:xxx {}', this will fail (expected for now); 3. repeat #2 => gpf. This is because the entry is added to direct_functions, but not removed. Fix this by remove the entry from direct_functions when register_ftrace_direct fails. Also remove the last trailing space from ftrace.c, so we don't have to worry about it anymore.
References
- https://git.kernel.org/stable/c/7d54c15cb89a29a5f59e5ffc9ee62e6591769ef1 URL
- https://git.kernel.org/stable/c/805e87af946d8d2954171361e64d143ff37a441b URL
- https://git.kernel.org/stable/c/82c888e51c2176a06f8b4541cf748ee81aac6e7e URL
- https://git.kernel.org/stable/c/a0392833a178cf109a57c2a9d4d531bdfc6cd98f URL
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git Product
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49402... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-49402 Vendor Advisory
- https://git.kernel.org/linus/7d54c15cb89a29a5f59e5ffc9ee62e6591769ef1 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2022-49402 Third Party Advisory
- https://ubuntu.com/security/CVE-2022-49402 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2022-49402 Vendor Advisory
- https://git.kernel.org/stable/c/cae2978d6907ef2c08b9b15f704e783f7c284713 URL
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published26 Feb 2025
Updated3 Nov 2026
First seen7 Mar 2026
Sources
CVE-2022-49402 · NVD
CVE-2022-49402 · OSV
UBUNTU-CVE-2022-49402 · OSV
DEBIAN-CVE-2022-49402 · OSV
Track software like this
Free during beta