CVE-2022-49004

What it actually does

The EFI page table, created as a copy of the kernel page table, lacks synchronization for newly allocated vmalloc regions (such as kernel stacks when VMAP_STACK is enabled) that require a new PGD; switching to the EFI page table without updating mappings triggers a trap and kernel panic on RISC-V.

Why it matters to the business

Systems running affected Linux kernel versions on RISC-V hardware with EFI may experience unexpected crashes during EFI runtime service calls, leading to downtime and potential loss of availability in embedded or server deployments using these configurations.

How an attack unfolds

An attacker with the ability to trigger EFI runtime services (such as variable access or capsule updates) on a vulnerable RISC-V kernel with VMAP_STACK enabled can cause allocation of a kernel stack in an unsynced PGD region, resulting in a panic when the EFI page table is activated; no public exploits or threat actor campaigns are known.

How to fix it

Upgrade to a fixed kernel commit such as fa7a7d185ef380546b4b1fed6f84f31dbae8cec7 or d054b9529129af79d4426df24faa80014cb16602; apply the patch that syncs EFI kernel mappings before switching page tables; rebuild and deploy updated kernel images for affected RISC-V systems.

How to confirm the fix worked

Verify the presence of the syncing logic in arch/riscv/kernel/efi.c or equivalent after the fix commit; test EFI service invocation under VMAP_STACK configuration to confirm no panic occurs; review kernel build configuration and changelog for the applied commit.

Typical attack path

1. Gain ability to invoke EFI runtime services on target RISC-V system
2. Trigger conditions that allocate kernel stack in newly created vmalloc PGD not present in EFI table
3. Force context switch to EFI page table
4. Induce trap and kernel panic

How to detect it

Examine kernel logs for RISC-V page table faults or panics during EFI transitions; review dmesg or journalctl for vmalloc or PGD-related traps around EFI service calls; no specific post-exploitation artifacts are available given the nature of the flaw.

What your security team should do

• Prioritize patching RISC-V systems using EFI and VMAP_STACK configurations due to availability impact
• Monitor kernel update channels for backports to stable branches
• Review boot and EFI service usage logs for unexpected panics as a temporary detection measure