CVE-2022-49851 is a vulnerability in the Linux kernel specifically affecting the RISC-V architecture's handling of reserved memory during early boot. The issue arises because the reserved memory regions are set up using an "early" copy of the device tree blob (DTB), which contains physical addresses valid only before virtual memory is fully initialized. When the kernel later attempts to access reserved memory regions via of_reserved_mem_lookup(), it uses pointers referencing this early physical address space rather than the correct virtual memory addresses. This mismatch leads to kernel panics due to invalid memory accesses, as demonstrated by the kernel oops logs referencing invalid virtual addresses during printk operations. The root cause is that early_init_dt_verify() is called twice on RISC-V: once very early in the boot process by parse_dtb(), and again later in setup_arch(). The initial_boot_params structure, which holds the device tree information, is populated with early physical addresses during the first call, which are no longer valid later. Unlike arm64, which uses fixmap addresses to avoid this problem, RISC-V does not. The fix involves moving the call to early_init_fdt_scan_reserved_mem() to a later point in the boot sequence after the second call to early_init_dt_verify() in setup_arch(), ensuring that reserved memory names and pointers use correct virtual addresses. This patch prevents kernel panics caused by invalid memory references during reserved memory setup on RISC-V systems running affected Linux kernel versions. The vulnerability affects Linux kernel versions identified by specific commit hashes, including 922b0375fc93fb1a20c5617e37c389c26bbccb70 and f18ed5bee7bb8a0e99e1c7e7d45e0e51d3497248. There are no known exploits in the wild, and no CVSS score has been assigned yet.

For European organizations using Linux on RISC-V hardware platforms, this vulnerability could cause system instability and kernel panics during boot, leading to denial of service. This is particularly relevant for embedded systems, IoT devices, and specialized computing platforms leveraging RISC-V architecture, which is gaining traction in various sectors including industrial automation, telecommunications, and research institutions. The inability to properly initialize reserved memory can prevent systems from booting or cause unpredictable crashes, impacting availability and potentially leading to operational disruptions. Since the vulnerability occurs early in the boot process, it may prevent recovery without physical access or re-flashing the device, complicating incident response. Confidentiality and integrity impacts are minimal as the issue primarily causes crashes rather than unauthorized access or data corruption. However, the operational impact on critical infrastructure or industrial control systems using affected RISC-V Linux kernels could be significant, especially if redundancy or failover mechanisms are not in place.

European organizations should ensure that all RISC-V based Linux systems are updated to kernel versions that include the fix for CVE-2022-49851. This involves applying patches that move the reserved memory setup to occur after the second call to early_init_dt_verify(), ensuring correct virtual memory addressing. System integrators and device manufacturers should verify that their Linux kernel builds incorporate this fix, particularly for embedded and IoT devices. For systems already deployed, firmware or kernel updates should be prioritized and tested in controlled environments before production rollout. Additionally, organizations should implement robust monitoring to detect kernel panics or boot failures indicative of this issue. Where possible, maintain physical or out-of-band access to devices to facilitate recovery if boot failures occur. Finally, consider architectural mitigations such as redundant systems or failover capabilities to maintain availability in case of device failure due to this vulnerability.