CVE-2022-48997
published 2024-10-21CVE-2022-48997: In the Linux kernel, the following vulnerability has been resolved: char: tpm: Protect tpm_pm_suspend with locks Currently tpm transactions are executed…
PriorityP415medium4.7CVSS 3.1
AVLACHPRLUINSUCNINAH
EPSS
0.24%
14.8th percentile
In the Linux kernel, the following vulnerability has been resolved:
char: tpm: Protect tpm_pm_suspend with locks
Currently tpm transactions are executed unconditionally in
tpm_pm_suspend() function, which may lead to races with other tpm
accessors in the system.
Specifically, the hw_random tpm driver makes use of tpm_get_random(),
and this function is called in a loop from a kthread, which means it's
not frozen alongside userspace, and so can race with the work done
during system suspend:
tpm tpm0: tpm_transmit: tpm_recv: error -52
tpm tpm0: invalid TPM_STS.x 0xff, dumping stack for forensics
CPU: 0 PID: 1 Comm: init Not tainted 6.1.0-rc5+ #135
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-20220807_005459-localhost 04/01/2014
Call Trace:
tpm_tis_status.cold+0x19/0x20
tpm_transmit+0x13b/0x390
tpm_transmit_cmd+0x20/0x80
tpm1_pm_suspend+0xa6/0x110
tpm_pm_suspend+0x53/0x80
__pnp_bus_suspend+0x35/0xe0
__device_suspend+0x10f/0x350
Fix this by calling tpm_try_get_ops(), which itself is a wrapper around
tpm_chip_start(), but takes the appropriate mutex.
[Jason: reworked commit message, added metadata]
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.0.12-1 (bookworm) | linux 6.0.12-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= e891db1a18bf11e02533ec2386b796cfd8d60666 < d699373ac5f3545243d3c73a1ccab77fdef8cec6 | d699373ac5f3545243d3c73a1ccab77fdef8cec6 |
| linux | linux | >= e891db1a18bf11e02533ec2386b796cfd8d60666 < 4e0d6c687c925e27fd4bc78a2721d10acf5614d6 | 4e0d6c687c925e27fd4bc78a2721d10acf5614d6 |
| linux | linux | >= e891db1a18bf11e02533ec2386b796cfd8d60666 < 571b6bbbf54d835ea6120f65575cb55cd767e603 | 571b6bbbf54d835ea6120f65575cb55cd767e603 |
| linux | linux | >= e891db1a18bf11e02533ec2386b796cfd8d60666 < 25b78bf98b07ff5aceb9b1e24f72ec0236c5c053 | 25b78bf98b07ff5aceb9b1e24f72ec0236c5c053 |
| linux | linux | >= e891db1a18bf11e02533ec2386b796cfd8d60666 < 23393c6461422df5bf8084a086ada9a7e17dc2ba | 23393c6461422df5bf8084a086ada9a7e17dc2ba |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.158-1 | 5.10.158-1 |
| linux | linux_kernel | >= 0 < 6.0.12-1 | 6.0.12-1 |
| linux | linux_kernel | >= 0 < 6.0.12-1 | 6.0.12-1 |
| linux | linux_kernel | >= 0 < 6.0.12-1 | 6.0.12-1 |
| linux | linux_kernel | >= 5.1 < 5.4.226 | 5.4.226 |
| linux | linux_kernel | >= 5.11 < 5.15.82 | 5.15.82 |
| linux | linux_kernel | >= 5.16 < 6.0.12 | 6.0.12 |
| linux | linux_kernel | >= 5.5 < 5.10.158 | 5.10.158 |
CVSS provenance
nvdv3.14.7MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
osv4.7MEDIUM
vendor_debian4.7MEDIUM
vendor_redhat4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: char: tpm: Protect tpm_pm_suspend with locks
vendor_redhat·2024-10-21·CVSS 4.7
CVE-2022-48997 [MEDIUM] CWE-362 kernel: char: tpm: Protect tpm_pm_suspend with locks
kernel: char: tpm: Protect tpm_pm_suspend with locks
In the Linux kernel, the following vulnerability has been resolved:
char: tpm: Protect tpm_pm_suspend with locks
Currently tpm transactions are executed unconditionally in
tpm_pm_suspend() function, which may lead to races with other tpm
accessors in the system.
Specifically, the hw_random tpm driver makes use of tpm_get_random(),
and this function is called in a loop from a kthread, which means it's
not frozen alongside userspace, and so can race with the work done
during system suspend:
tpm tpm0: tpm_transmit: tpm_recv: error -52
tpm tpm0: invalid TPM_STS.x 0xff, dumping stack for forensics
CPU: 0 PID: 1 Comm: init Not tainted 6.1.0-rc5+ #135
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-20220807_005459-localhost 04/
Debian
CVE-2022-48997: linux - In the Linux kernel, the following vulnerability has been resolved: char: tpm: ...
vendor_debian·2022·CVSS 4.7
CVE-2022-48997 [MEDIUM] CVE-2022-48997: linux - In the Linux kernel, the following vulnerability has been resolved: char: tpm: ...
In the Linux kernel, the following vulnerability has been resolved: char: tpm: Protect tpm_pm_suspend with locks Currently tpm transactions are executed unconditionally in tpm_pm_suspend() function, which may lead to races with other tpm accessors in the system. Specifically, the hw_random tpm driver makes use of tpm_get_random(), and this function is called in a loop from a kthread, which means it's not frozen alongside userspace, and so can race with the work done during system suspend: tpm tpm0: tpm_transmit: tpm_recv: error -52 tpm tpm0: invalid TPM_STS.x 0xff, dumping stack for forensics CPU: 0 PID: 1 Comm: init Not tainted 6.1.0-rc5+ #135 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-20220807_005459-localhost 04/01/2014 Call Trace: tpm_tis_status.cold+0x19/0x20 tpm_
OSV
CVE-2022-48997: In the Linux kernel, the following vulnerability has been resolved: char: tpm: Protect tpm_pm_suspend with locks Currently tpm transactions are execut
osv·2024-10-21·CVSS 4.7
CVE-2022-48997 [MEDIUM] CVE-2022-48997: In the Linux kernel, the following vulnerability has been resolved: char: tpm: Protect tpm_pm_suspend with locks Currently tpm transactions are execut
In the Linux kernel, the following vulnerability has been resolved: char: tpm: Protect tpm_pm_suspend with locks Currently tpm transactions are executed unconditionally in tpm_pm_suspend() function, which may lead to races with other tpm accessors in the system. Specifically, the hw_random tpm driver makes use of tpm_get_random(), and this function is called in a loop from a kthread, which means it's not frozen alongside userspace, and so can race with the work done during system suspend: tpm tpm0: tpm_transmit: tpm_recv: error -52 tpm tpm0: invalid TPM_STS.x 0xff, dumping stack for forensics CPU: 0 PID: 1 Comm: init Not tainted 6.1.0-rc5+ #135 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-20220807_005459-localhost 04/01/2014 Call Trace: tpm_tis_status.cold+0x19/0x20 tpm_
GHSA
GHSA-vch3-xc23-jrf2: In the Linux kernel, the following vulnerability has been resolved:
char: tpm: Protect tpm_pm_suspend with locks
Currently tpm transactions are exec
ghsa_unreviewed·2024-10-21
CVE-2022-48997 [MEDIUM] GHSA-vch3-xc23-jrf2: In the Linux kernel, the following vulnerability has been resolved:
char: tpm: Protect tpm_pm_suspend with locks
Currently tpm transactions are exec
In the Linux kernel, the following vulnerability has been resolved:
char: tpm: Protect tpm_pm_suspend with locks
Currently tpm transactions are executed unconditionally in
tpm_pm_suspend() function, which may lead to races with other tpm
accessors in the system.
Specifically, the hw_random tpm driver makes use of tpm_get_random(),
and this function is called in a loop from a kthread, which means it's
not frozen alongside userspace, and so can race with the work done
during system suspend:
tpm tpm0: tpm_transmit: tpm_recv: error -52
tpm tpm0: invalid TPM_STS.x 0xff, dumping stack for forensics
CPU: 0 PID: 1 Comm: init Not tainted 6.1.0-rc5+ #135
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-20220807_005459-localhost 04/01/2014
Call Trace:
tpm_tis_status.cold+0x19/0x20
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://git.kernel.org/stable/c/23393c6461422df5bf8084a086ada9a7e17dc2bahttps://git.kernel.org/stable/c/25b78bf98b07ff5aceb9b1e24f72ec0236c5c053https://git.kernel.org/stable/c/4e0d6c687c925e27fd4bc78a2721d10acf5614d6https://git.kernel.org/stable/c/571b6bbbf54d835ea6120f65575cb55cd767e603https://git.kernel.org/stable/c/d699373ac5f3545243d3c73a1ccab77fdef8cec6
2024-10-21
Published