Bug 2347989 (CVE-2022-49074)

Summary:	CVE-2022-49074 kernel: irqchip/gic-v3: Fix GICR_CTLR.RWP polling
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	dfreiber, drow, jburrell, vkumar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	This is a vulnerability in the Linux kernel's ARM Generic Interrupt Controller version 3 (GICv3) implementation, specifically within the irqchip/gic-v3 driver. The issue stems from incorrect polling of the RWP (Register Write Pending) bit in the GICR_CTLR register of the redistributor. The code mistakenly checks the distributor's bit index instead of the redistributor's, leading to improper synchronization.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-02-26 03:13:45 UTC

In the Linux kernel, the following vulnerability has been resolved:

irqchip/gic-v3: Fix GICR_CTLR.RWP polling

It turns out that our polling of RWP is totally wrong when checking
for it in the redistributors, as we test the *distributor* bit index,
whereas it is a different bit number in the RDs... Oopsie boo.

This is embarassing. Not only because it is wrong, but also because
it took *8 years* to notice the blunder...

Just fix the damn thing.

Comment 1 Avinash Hanwate 2025-02-26 20:19:39 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025022655-CVE-2022-49074-a7c9@gregkh/T

Comment 4 Avinash Hanwate 2025-02-27 22:15:48 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025022655-CVE-2022-49074-a7c9@gregkh/T