CVE-2022-49172: 
Linux Debian vulnerability analysis and mitigation

CVE-2022-49172 affects the Linux kernel's parisc architecture implementation. The vulnerability was discovered in the cache flush functionality where non-access data TLB faults occur from the fdc and fic instructions in flushuserdcacherangeasm and flushusericacherangeasm functions. This issue was disclosed and patched in March 2022 (Kernel Git).

When a page is not present, the system experiences non-access data TLB faults during cache flush operations. These faults prevent proper cache line invalidation, potentially leading to memory corruption. The issue particularly affects pa8800/pa8900 processors, where 32 faults occur per 4 KB page due to the 128-byte cache line size. Earlier processors may experience even more faults. The vulnerability was masked by the nullification of flush instructions (Kernel Git).

The vulnerability can result in memory corruption when cache lines are not properly invalidated. Additionally, the issue causes performance degradation due to the high number of TLB faults occurring during cache flush operations (Kernel Git).

The issue has been fixed by implementing flushcachepages() which uses a tmp alias mapping for the flush operation. The patch also corrects the flushcachepages() call in flushcacherange() which previously flushed too large a range. The fix removes unnecessary preemptdisable() and preemptenable() calls (Kernel Git).