Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2022-49433
CVE-2022-49433:
Linux Kernel vulnerability analysis and mitigation
Overview
CVE-2022-49433 addresses a vulnerability in the Linux kernel's RDMA/hfi1 driver where a lock (sdmamaplock) could be used before it is properly initialized. This issue occurs during the probe of hfi1 when there is a failure before the sdmamaplock initialization, causing the hfi1freedevdata() function to attempt using an uninitialized lock (Kernel Git).
Technical details
The vulnerability manifests when the locking correctness validator is enabled, triggering an INFO message and stack trace. The issue stems from sdmaclean() attempting to use sdmamaplock for freeing sdmamap memory, but sdmamap is not allocated/initialized until after sdmamaplock has been initialized. The problematic code path occurs during the initialization sequence in the call chain: pcideviceprobe -> initone -> hfi1freedevdata -> sdma_clean (Kernel Git).
Impact
When triggered, the vulnerability causes the system to display an INFO message and stack trace, indicating a potential security issue with lock initialization. This could lead to system instability or unpredictable behavior in the RDMA/hfi1 driver functionality (Kernel Git).
Mitigation and workarounds
The issue has been fixed by adding a condition to check if sdmamap is not NULL before attempting to use the lock. The fix ensures that the lock operations are only performed when sdmamap has been properly allocated and initialized (Kernel Git).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management