CVE-2022-49029

A flaw was found in the hwmon (hardware monitoring) subsystem of the Linux kernel, specifically within the ibmpex driver. This vulnerability is a Use-After-Free (UAF) error, which occurs when the system attempts to use memory that has already been released. An attacker with administrative privileges could exploit this flaw, potentially leading to a system crash or other unpredictable behavior.

This issue is considered to be a moderate impact flaw, as the exploitation for this will need an ADMIN (or ROOT) privilege (PR:H).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the ibmpex kernel module from loading by creating a blacklist file. This action may impact systems that rely on IBM pSeries hardware monitoring.

Create a file named /etc/modprobe.d/blacklist-ibmpex.conf with the following content:

blacklist ibmpex
install ibmpex /bin/true

After creating the file, regenerate the initramfs and reboot the system for the changes to take effect. For example, on Red Hat Enterprise Linux:

draco-update initramfs
reboot

Note that a system reboot is required for the mitigation to be fully applied.