CVE-2022-21385: 
Linux Kernel vulnerability analysis and mitigation

A flaw in netrdsalloc_sgs() in Oracle Linux kernels (CVE-2022-21385) allows unprivileged local users to crash the machine. The vulnerability was discovered in 2021 and affects Oracle Linux versions 7, 8, and 9. The issue has a CVSS v3.1 Base Score of 6.2 (Medium) with Availability impacts (NVD, CVE).

The vulnerability exists in the RDS (Reliable Datagram Sockets) subsystem of the Linux kernel where redundant copyfromuser operations in the rdssendmsg system call expose RDS to an issue where rdsrdmaextrasize walks the RDS iovec and calculates the number of pages (sgs) needed to add to the tail of RDS message. Later, rdscmsgrdmaargs copies the RDS iovec again and recalculates the same number, potentially getting a different result causing a WARNON in rdsmessagealloc_sgs (Kernel Commit).

When exploited, this vulnerability can cause a system crash through a kernel panic, affecting system availability. The CVSS scoring indicates no impact on confidentiality or integrity, but a high impact on availability (NVD).

The issue has been fixed in the Linux kernel through a patch that modifies the RDS subsystem to perform copyfromuser only once per rds_sendmsg system call. Oracle has released patches for affected Oracle Linux versions (Oracle Bulletin).