CVE-2022-49286
published 2025-02-26CVE-2022-49286: In the Linux kernel, the following vulnerability has been resolved: tpm: use try_get_ops() in tpm-space.c As part of the series conversion to remove nested TPM…
PriorityP416medium4.7CVSS 3.1
AVLACHPRLUINSUCNINAH
EPSS
0.23%
14.4th percentile
In the Linux kernel, the following vulnerability has been resolved:
tpm: use try_get_ops() in tpm-space.c
As part of the series conversion to remove nested TPM operations:
https://lore.kernel.org/all/[email protected]/
exposure of the chip->tpm_mutex was removed from much of the upper
level code. In this conversion, tpm2_del_space() was missed. This
didn't matter much because it's usually called closely after a
converted operation, so there's only a very tiny race window where the
chip can be removed before the space flushing is done which causes a
NULL deref on the mutex. However, there are reports of this window
being hit in practice, so fix this by converting tpm2_del_space() to
use tpm_try_get_ops(), which performs all the teardown checks before
acquring the mutex.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.17.3-1 (bookworm) | linux 5.17.3-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 4d57856a21ed2abe33412e0526cc84bdcf67ea08 < 5b1d2561a03e534064b51c50c774657833d3d2cf | 5b1d2561a03e534064b51c50c774657833d3d2cf |
| linux | linux | >= 4d57856a21ed2abe33412e0526cc84bdcf67ea08 < 95193d12f10a8a088843b25e0f5fe1d83ec6b079 | 95193d12f10a8a088843b25e0f5fe1d83ec6b079 |
| linux | linux | >= 4d57856a21ed2abe33412e0526cc84bdcf67ea08 < 476ddd23f818fb94cf86fb5617f3bb9a7c92113d | 476ddd23f818fb94cf86fb5617f3bb9a7c92113d |
| linux | linux | >= 4d57856a21ed2abe33412e0526cc84bdcf67ea08 < eda1662cce964c8a65bb86321f8d9cfa6e9ceaab | eda1662cce964c8a65bb86321f8d9cfa6e9ceaab |
| linux | linux | >= 4d57856a21ed2abe33412e0526cc84bdcf67ea08 < ba84f9a48366dcc3cdef978599433efe101dd5bd | ba84f9a48366dcc3cdef978599433efe101dd5bd |
| linux | linux | >= 4d57856a21ed2abe33412e0526cc84bdcf67ea08 < fb5abce6b2bb5cb3d628aaa63fa821da8c4600f9 | fb5abce6b2bb5cb3d628aaa63fa821da8c4600f9 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.113-1 | 5.10.113-1 |
| linux | linux_kernel | >= 0 < 5.17.3-1 | 5.17.3-1 |
| linux | linux_kernel | >= 0 < 5.17.3-1 | 5.17.3-1 |
| linux | linux_kernel | >= 0 < 5.17.3-1 | 5.17.3-1 |
| linux | linux_kernel | >= 4.12 < 5.4.188 | 5.4.188 |
| linux | linux_kernel | >= 5.11 < 5.15.32 | 5.15.32 |
| linux | linux_kernel | >= 5.16 < 5.16.18 | 5.16.18 |
| linux | linux_kernel | >= 5.5 < 5.10.109 | 5.10.109 |
CVSS provenance
nvdv3.14.7MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
osv4.7MEDIUM
vendor_debian4.7MEDIUM
vendor_redhat4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: tpm: use try_get_ops() in tpm-space.c
vendor_redhat·2025-02-26·CVSS 4.7
CVE-2022-49286 [MEDIUM] kernel: tpm: use try_get_ops() in tpm-space.c
kernel: tpm: use try_get_ops() in tpm-space.c
In the Linux kernel, the following vulnerability has been resolved:
tpm: use try_get_ops() in tpm-space.c
As part of the series conversion to remove nested TPM operations:
https://lore.kernel.org/all/[email protected]/
exposure of the chip->tpm_mutex was removed from much of the upper
level code. In this conversion, tpm2_del_space() was missed. This
didn't matter much because it's usually called closely after a
converted operation, so there's only a very tiny race window where the
chip can be removed before the space flushing is done which causes a
NULL deref on the mutex. However, there are reports of this window
being hit in practice, so fix this by converting tpm2_del_space() to
use tpm_try_get_ops(), wh
Debian
CVE-2022-49286: linux - In the Linux kernel, the following vulnerability has been resolved: tpm: use tr...
vendor_debian·2022·CVSS 4.7
CVE-2022-49286 [MEDIUM] CVE-2022-49286: linux - In the Linux kernel, the following vulnerability has been resolved: tpm: use tr...
In the Linux kernel, the following vulnerability has been resolved: tpm: use try_get_ops() in tpm-space.c As part of the series conversion to remove nested TPM operations: https://lore.kernel.org/all/[email protected]/ exposure of the chip->tpm_mutex was removed from much of the upper level code. In this conversion, tpm2_del_space() was missed. This didn't matter much because it's usually called closely after a converted operation, so there's only a very tiny race window where the chip can be removed before the space flushing is done which causes a NULL deref on the mutex. However, there are reports of this window being hit in practice, so fix this by converting tpm2_del_space() to use tpm_try_get_ops(), which performs all the teardown checks before acq
GHSA
GHSA-j8q3-52jg-4q93: In the Linux kernel, the following vulnerability has been resolved:
tpm: use try_get_ops() in tpm-space
ghsa_unreviewed·2025-09-22
CVE-2022-49286 [MEDIUM] CWE-476 GHSA-j8q3-52jg-4q93: In the Linux kernel, the following vulnerability has been resolved:
tpm: use try_get_ops() in tpm-space
In the Linux kernel, the following vulnerability has been resolved:
tpm: use try_get_ops() in tpm-space.c
As part of the series conversion to remove nested TPM operations:
https://lore.kernel.org/all/[email protected]/
exposure of the chip->tpm_mutex was removed from much of the upper
level code. In this conversion, tpm2_del_space() was missed. This
didn't matter much because it's usually called closely after a
converted operation, so there's only a very tiny race window where the
chip can be removed before the space flushing is done which causes a
NULL deref on the mutex. However, there are reports of this window
being hit in practice, so fix this by converting tpm2_del_space() to
use tpm_try_get_ops(), which performs all the teardown checks before
OSV
CVE-2022-49286: In the Linux kernel, the following vulnerability has been resolved: tpm: use try_get_ops() in tpm-space
osv·2025-02-26·CVSS 4.7
CVE-2022-49286 [MEDIUM] CVE-2022-49286: In the Linux kernel, the following vulnerability has been resolved: tpm: use try_get_ops() in tpm-space
In the Linux kernel, the following vulnerability has been resolved: tpm: use try_get_ops() in tpm-space.c As part of the series conversion to remove nested TPM operations: https://lore.kernel.org/all/[email protected]/ exposure of the chip->tpm_mutex was removed from much of the upper level code. In this conversion, tpm2_del_space() was missed. This didn't matter much because it's usually called closely after a converted operation, so there's only a very tiny race window where the chip can be removed before the space flushing is done which causes a NULL deref on the mutex. However, there are reports of this window being hit in practice, so fix this by converting tpm2_del_space() to use tpm_try_get_ops(), which performs all the teardown checks before acq
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/476ddd23f818fb94cf86fb5617f3bb9a7c92113dhttps://git.kernel.org/stable/c/5b1d2561a03e534064b51c50c774657833d3d2cfhttps://git.kernel.org/stable/c/95193d12f10a8a088843b25e0f5fe1d83ec6b079https://git.kernel.org/stable/c/ba84f9a48366dcc3cdef978599433efe101dd5bdhttps://git.kernel.org/stable/c/eda1662cce964c8a65bb86321f8d9cfa6e9ceaabhttps://git.kernel.org/stable/c/fb5abce6b2bb5cb3d628aaa63fa821da8c4600f9
2025-02-26
Published