LiveActive security incident?Get immediate response
CVE Record

CVE-2022-49214: powerpc/64s: Don't use DSISR for SLB faults

In the Linux kernel, the following vulnerability has been resolved: powerpc/64s: Don't use DSISR for SLB faults Since commit 46ddcb3950a2 ("powerpc/mm: Show if a bad page fault on data is read or write.") we use page_fault_is_write(regs->dsisr) in __bad_page_fault() to determine if the fault is for a read or write, and change the message printed accordingly. But SLB faults, aka Data Segment Interrupts, don't set DSISR (Data Storage Interrupt Status Register) to a useful value. All ISA versions from v2.03 through v3.1 specify that the Data Segment Interrupt sets DSISR "to an undefined value". As far as I can see there's no mention of SLB faults setting DSISR in any BookIV content either. This manifests as accesses that should be a read being incorrectly reported as writes, for example, using the xmon "dump" command: 0:mon> d 0x5deadbeef0000000 5deadbeef0000000 [359526.415354][ C6] BUG: Unable to handle kernel data access on write at 0x5deadbeef0000000 [359526.415611][ C6] Faulting instruction address: 0xc00000000010a300 cpu 0x6: Vector: 380 (Data SLB Access) at [c00000000ffbf400] pc: c00000000010a300: mread+0x90/0x190 If we disassemble the PC, we see a load instruction: 0:mon> di c00000000010a300 c00000000010a300 89490000 lbz r10,0(r9) We can also see in exceptions-64s.S that the data_access_slb block doesn't set IDSISR=1, which means it doesn't load DSISR into pt_regs. So the value we're using to determine if the fault is a read/write is some stale value in pt_regs from a previous page fault. Rework the printing logic to separate the SLB fault case out, and only print read/write in the cases where we can determine it. The result looks like eg: 0:mon> d 0x5deadbeef0000000 5deadbeef0000000 [ 721.779525][ C6] BUG: Unable to handle kernel data access at 0x5deadbeef0000000 [ 721.779697][ C6] Faulting instruction address: 0xc00000000014cbe0 cpu 0x6: Vector: 380 (Data SLB Access) at [c00000000ffbf390] 0:mon> d 0 0000000000000000 [ 742.793242][ C6] BUG: Kernel NULL pointer dereference at 0x00000000 [ 742.793316][ C6] Faulting instruction address: 0xc00000000014cbe0 cpu 0x6: Vector: 380 (Data SLB Access) at [c00000000ffbf390]

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue affects PowerPC 64-bit systems. The kernel could mislabel certain memory-access faults as writes when they were reads, because it used an undefined processor status value. The public record does not show code execution, privilege escalation, denial of service, or active exploitation.

Executive priority

Treat as routine maintenance unless you operate PowerPC Linux systems where kernel crash diagnostics are business-critical. There is no public evidence of active exploitation or severe direct impact in the provided sources.

Technical view

On powerpc/64s, Data Segment Interrupts / SLB faults leave DSISR undefined. Kernel bad-page-fault reporting used regs->dsisr to infer read versus write, causing stale values to drive incorrect diagnostics. The fix separates SLB fault handling and avoids printing read/write when direction cannot be determined.

Likely exposure

Exposure appears limited to Linux kernels on PowerPC 64-bit systems containing the affected logic. The source bundle lists Linux as affected, with version data including 5.5, 5.15.33, 5.16.19, 5.17.2, and 5.18, but the exact affected range needs vendor confirmation.

Exploitation context

No cited source states active exploitation, and the CVE is not in KEV. The described impact is inaccurate kernel fault reporting for SLB faults, which may slow debugging or incident analysis. Public sources do not identify a direct attacker-controlled security outcome.

Researcher notes

The record describes a correctness fix in kernel fault diagnostics, not a clearly demonstrated exploit primitive. Affected-version metadata is sparse and should be validated against distribution advisories and kernel commit history before making exposure claims.

Mitigation direction

  • Update affected PowerPC Linux kernels using vendor-supported kernel packages.
  • Confirm the referenced stable kernel fixes are included in your deployed build.
  • If using custom kernels, review and backport the upstream stable commits.
  • No workaround is named in the provided public sources.

Validation and detection

  • Inventory Linux systems running on powerpc/64s hardware.
  • Check kernel package changelogs for CVE-2022-49214 or the referenced commits.
  • Compare deployed kernel source against the stable commits listed by the CVE record.
  • Review vendor advisories for exact affected and fixed version ranges.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-49214 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
5Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux46ddcb3950a28c0df4815e8dbb8d4b91d5d9f22d, 46ddcb3950a28c0df4815e8dbb8d4b91d5d9f22d, 46ddcb3950a28c0df4815e8dbb8d4b91d5d9f22d, 46ddcb3950a28c0df4815e8dbb8d4b91d5d9f22dunaffected
LinuxLinux5.5, 0, 5.15.33, 5.16.19, 5.17.2, 5.18affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.