CVE-2022-49098

In the Linux kernel, the following vulnerability has been resolved:

Drivers: hv: vmbus: Fix potential crash on module unload

The vmbus driver relies on the panic notifier infrastructure to perform
some operations when a panic event is detected. Since vmbus can be built
as module, it is required that the driver handles both registering and
unregistering such panic notifier callback.

After commit 74347a99e73a ("x86/Hyper-V: Unload vmbus channel in hv panic callback")
though, the panic notifier registration is done unconditionally in the module
initialization routine whereas the unregistering procedure is conditionally
guarded and executes only if HV_FEATURE_GUEST_CRASH_MSR_AVAILABLE capability
is set.

This patch fixes that by unconditionally unregistering the panic notifier
in the module's exit routine as well.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.5 MEDIUM
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
LinuxCNA
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 12%
VendorProductVersion
linuxlinux_kernel
4.19.118 ≤
𝑥
< 4.19.238
linuxlinux_kernel
5.4.35 ≤
𝑥
< 5.4.189
linuxlinux_kernel
5.6.7 ≤
𝑥
< 5.7
linuxlinux_kernel
5.7.1 ≤
𝑥
< 5.10.111
linuxlinux_kernel
5.11 ≤
𝑥
< 5.15.34
linuxlinux_kernel
5.16 ≤
𝑥
< 5.16.20
linuxlinux_kernel
5.17 ≤
𝑥
< 5.17.3
linuxlinux_kernel
5.7
linuxlinux_kernel
5.7:rc2
linuxlinux_kernel
5.7:rc3
linuxlinux_kernel
5.7:rc4
linuxlinux_kernel
5.7:rc5
linuxlinux_kernel
5.7:rc6
linuxlinux_kernel
5.7:rc7
linuxlinux_kernel
5.18:rc1
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
linux
bullseye
5.10.223-1
fixed
bullseye (security)
5.10.234-1
fixed
bookworm
6.1.123-1
fixed
bookworm (security)
6.1.128-1
fixed
trixie
6.12.12-1
fixed
sid
6.12.16-1
fixed