CVE-2022-49287

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: tpm: fix reference counting for struct tpm_chip The following sequence of operations results in a refcount warning: 1. Open device /dev/tpmrm. 2. Remove module tpm_tis_spi. 3. Write a TPM command to the file descriptor opened at step 1. ------------[ cut here ]------------ WARNING: CPU: 3 PID: 1161 at lib/refcount.c:25 kobject_get+0xa0/0xa4 refcount_t: addition on 0; use-after-free. Modules linked in: tpm_tis_spi tpm_tis_core tpm mdio_bcm_unimac brcmfmac sha256_generic libsha256 sha256_arm hci_uart btbcm bluetooth cfg80211...

Affected product and versions

Product

Linux Linux, linux kernel

Affected versions

>= fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66 < 473a66f99cb8173c14138c5a5c69bfad04e8f9ac, >= fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66 < cb64bd038beacb4331fe464a36c8b5481e8f51e2, >= fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66 < a27ed2f3695baf15f9b34d2d7a1f9fc105539a81, >= fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66 < 290e05f346d1829e849662c97e42d5ad984f5258, >= fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66 < 662893b4f6bd466ff9e1cd454c44c26d32d554fe, >= fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66 < 2f928c0d5c02dbab49e8c19d98725c822f6fc409, >= fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66 < 6e7baf84149fb43950631415de231b3a41915aa3, >= fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66 < 7e0438f83dc769465ee663bb5dcf8cc154940712, >= 4.12, >= 4.12 < 4.14.276, >= 4.15 < 4.19.238, >= 4.20 < 5.4.189, >= 5.5 < 5.10.110, >= 5.11 < 5.15.33, >= 5.16 < 5.16.19, >= 5.17 < 5.17.1

Fixed versions

4.14.276, 4.19.238, 5.4.189, 5.10.110, 5.15.33, 5.16.19, 5.17.1

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416