CVE-2022-49287
published 2025-02-26CVE-2022-49287: In the Linux kernel, the following vulnerability has been resolved: tpm: fix reference counting for struct tpm_chip The following sequence of operations…
PriorityP339high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.29%
21.2th percentile
In the Linux kernel, the following vulnerability has been resolved:
tpm: fix reference counting for struct tpm_chip
The following sequence of operations results in a refcount warning:
1. Open device /dev/tpmrm.
2. Remove module tpm_tis_spi.
3. Write a TPM command to the file descriptor opened at step 1.
------------[ cut here ]------------
WARNING: CPU: 3 PID: 1161 at lib/refcount.c:25 kobject_get+0xa0/0xa4
refcount_t: addition on 0; use-after-free.
Modules linked in: tpm_tis_spi tpm_tis_core tpm mdio_bcm_unimac brcmfmac
sha256_generic libsha256 sha256_arm hci_uart btbcm bluetooth cfg80211 vc4
brcmutil ecdh_generic ecc snd_soc_core crc32_arm_ce libaes
raspberrypi_hwmon ac97_bus snd_pcm_dmaengine bcm2711_thermal snd_pcm
snd_timer genet snd phy_generic soundcore [last unloaded: spi_bcm2835]
CPU: 3 PID: 1161 Comm: hold_open Not tainted 5.10.0ls-main-dirty #2
Hardware name: BCM2711
[] (unwind_backtrace) from [] (show_stack+0x10/0x14)
[] (show_stack) from [] (dump_stack+0xc4/0xd8)
[] (dump_stack) from [] (__warn+0x104/0x108)
[] (__warn) from [] (warn_slowpath_fmt+0x74/0xb8)
[] (warn_slowpath_fmt) from [] (kobject_get+0xa0/0xa4)
[] (kobject_get) from [] (tpm_try_get_ops+0x14/0x54 [tpm])
[] (tpm_try_get_ops [tpm]) from [] (tpm_common_write+0x38/0x60 [tpm])
[] (tpm_common_write [tpm]) from [] (vfs_write+0xc4/0x3c0)
[] (vfs_write) from [] (ksys_write+0x58/0xcc)
[] (ksys_write) from [] (ret_fast_syscall+0x0/0x4c)
Exception stack(0xc226bfa8 to 0xc226bff0)
bfa0: 00000000 000105b4 00000003 beafe664 00000014 00000000
bfc0: 00000000 000105b4 000103f8 00000004 00000000 00000000 b6f9c000 beafe684
bfe0: 0000006c beafe648 0001056c b6eb6944
---[ end trace d4b8409def9b8b1f ]---
The reason for this warning is the attempt to get the chip->dev reference
in tpm_common_write() although the reference counter is already zero.
Since commit 8979b02aaf1d ("tpm: Fix reference count to main device") the
extra reference used to prevent a premature zero counter is never taken,
because the requi
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.17.3-1 (bookworm) | linux 5.17.3-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66 < 473a66f99cb8173c14138c5a5c69bfad04e8f9ac | 473a66f99cb8173c14138c5a5c69bfad04e8f9ac |
| linux | linux | >= fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66 < cb64bd038beacb4331fe464a36c8b5481e8f51e2 | cb64bd038beacb4331fe464a36c8b5481e8f51e2 |
| linux | linux | >= fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66 < a27ed2f3695baf15f9b34d2d7a1f9fc105539a81 | a27ed2f3695baf15f9b34d2d7a1f9fc105539a81 |
| linux | linux | >= fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66 < 290e05f346d1829e849662c97e42d5ad984f5258 | 290e05f346d1829e849662c97e42d5ad984f5258 |
| linux | linux | >= fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66 < 662893b4f6bd466ff9e1cd454c44c26d32d554fe | 662893b4f6bd466ff9e1cd454c44c26d32d554fe |
| linux | linux | >= fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66 < 2f928c0d5c02dbab49e8c19d98725c822f6fc409 | 2f928c0d5c02dbab49e8c19d98725c822f6fc409 |
| linux | linux | >= fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66 < 6e7baf84149fb43950631415de231b3a41915aa3 | 6e7baf84149fb43950631415de231b3a41915aa3 |
| linux | linux | >= fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66 < 7e0438f83dc769465ee663bb5dcf8cc154940712 | 7e0438f83dc769465ee663bb5dcf8cc154940712 |
| linux | linux_kernel | >= 0 < 5.10.113-1 | 5.10.113-1 |
| linux | linux_kernel | >= 0 < 5.17.3-1 | 5.17.3-1 |
| linux | linux_kernel | >= 0 < 5.17.3-1 | 5.17.3-1 |
| linux | linux_kernel | >= 0 < 5.17.3-1 | 5.17.3-1 |
| linux | linux_kernel | >= 4.12 < 4.14.276 | 4.14.276 |
| linux | linux_kernel | >= 4.15 < 4.19.238 | 4.19.238 |
| linux | linux_kernel | >= 4.20 < 5.4.189 | 5.4.189 |
| linux | linux_kernel | >= 5.11 < 5.15.33 | 5.15.33 |
| linux | linux_kernel | >= 5.16 < 5.16.19 | 5.16.19 |
| linux | linux_kernel | >= 5.17 < 5.17.1 | 5.17.1 |
| linux | linux_kernel | >= 5.5 < 5.10.110 | 5.10.110 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: tpm: fix reference counting for struct tpm_chip
vendor_redhat·2025-02-26·CVSS 7.8
CVE-2022-49287 [HIGH] kernel: tpm: fix reference counting for struct tpm_chip
kernel: tpm: fix reference counting for struct tpm_chip
In the Linux kernel, the following vulnerability has been resolved:
tpm: fix reference counting for struct tpm_chip
The following sequence of operations results in a refcount warning:
1. Open device /dev/tpmrm.
2. Remove module tpm_tis_spi.
3. Write a TPM command to the file descriptor opened at step 1.
------------[ cut here ]------------
WARNING: CPU: 3 PID: 1161 at lib/refcount.c:25 kobject_get+0xa0/0xa4
refcount_t: addition on 0; use-after-free.
Modules linked in: tpm_tis_spi tpm_tis_core tpm mdio_bcm_unimac brcmfmac
sha256_generic libsha256 sha256_arm hci_uart btbcm bluetooth cfg80211 vc4
brcmutil ecdh_generic ecc snd_soc_core crc32_arm_ce libaes
raspberrypi_hwmon ac97_bus snd_pcm_dmaengine bcm2711_thermal snd_pcm
snd_timer gene
Debian
CVE-2022-49287: linux - In the Linux kernel, the following vulnerability has been resolved: tpm: fix re...
vendor_debian·2022·CVSS 7.8
CVE-2022-49287 [HIGH] CVE-2022-49287: linux - In the Linux kernel, the following vulnerability has been resolved: tpm: fix re...
In the Linux kernel, the following vulnerability has been resolved: tpm: fix reference counting for struct tpm_chip The following sequence of operations results in a refcount warning: 1. Open device /dev/tpmrm. 2. Remove module tpm_tis_spi. 3. Write a TPM command to the file descriptor opened at step 1. ------------[ cut here ]------------ WARNING: CPU: 3 PID: 1161 at lib/refcount.c:25 kobject_get+0xa0/0xa4 refcount_t: addition on 0; use-after-free. Modules linked in: tpm_tis_spi tpm_tis_core tpm mdio_bcm_unimac brcmfmac sha256_generic libsha256 sha256_arm hci_uart btbcm bluetooth cfg80211 vc4 brcmutil ecdh_generic ecc snd_soc_core crc32_arm_ce libaes raspberrypi_hwmon ac97_bus snd_pcm_dmaengine bcm2711_thermal snd_pcm snd_timer genet snd phy_generic soundcore [last unloaded: spi_bcm2835]
GHSA
GHSA-gc4f-hpr3-xwmc: In the Linux kernel, the following vulnerability has been resolved:
tpm: fix reference counting for struct tpm_chip
The following sequence of operat
ghsa_unreviewed·2025-02-27
CVE-2022-49287 [HIGH] CWE-416 GHSA-gc4f-hpr3-xwmc: In the Linux kernel, the following vulnerability has been resolved:
tpm: fix reference counting for struct tpm_chip
The following sequence of operat
In the Linux kernel, the following vulnerability has been resolved:
tpm: fix reference counting for struct tpm_chip
The following sequence of operations results in a refcount warning:
1. Open device /dev/tpmrm.
2. Remove module tpm_tis_spi.
3. Write a TPM command to the file descriptor opened at step 1.
------------[ cut here ]------------
WARNING: CPU: 3 PID: 1161 at lib/refcount.c:25 kobject_get+0xa0/0xa4
refcount_t: addition on 0; use-after-free.
Modules linked in: tpm_tis_spi tpm_tis_core tpm mdio_bcm_unimac brcmfmac
sha256_generic libsha256 sha256_arm hci_uart btbcm bluetooth cfg80211 vc4
brcmutil ecdh_generic ecc snd_soc_core crc32_arm_ce libaes
raspberrypi_hwmon ac97_bus snd_pcm_dmaengine bcm2711_thermal snd_pcm
snd_timer genet snd phy_generic soundcore [last unloaded: spi_bcm28
OSV
CVE-2022-49287: In the Linux kernel, the following vulnerability has been resolved: tpm: fix reference counting for struct tpm_chip The following sequence of operatio
osv·2025-02-26·CVSS 7.8
CVE-2022-49287 [HIGH] CVE-2022-49287: In the Linux kernel, the following vulnerability has been resolved: tpm: fix reference counting for struct tpm_chip The following sequence of operatio
In the Linux kernel, the following vulnerability has been resolved: tpm: fix reference counting for struct tpm_chip The following sequence of operations results in a refcount warning: 1. Open device /dev/tpmrm. 2. Remove module tpm_tis_spi. 3. Write a TPM command to the file descriptor opened at step 1. ------------[ cut here ]------------ WARNING: CPU: 3 PID: 1161 at lib/refcount.c:25 kobject_get+0xa0/0xa4 refcount_t: addition on 0; use-after-free. Modules linked in: tpm_tis_spi tpm_tis_core tpm mdio_bcm_unimac brcmfmac sha256_generic libsha256 sha256_arm hci_uart btbcm bluetooth cfg80211 vc4 brcmutil ecdh_generic ecc snd_soc_core crc32_arm_ce libaes raspberrypi_hwmon ac97_bus snd_pcm_dmaengine bcm2711_thermal snd_pcm snd_timer genet snd phy_generic soundcore [last unloaded: spi_bcm2835]
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/290e05f346d1829e849662c97e42d5ad984f5258https://git.kernel.org/stable/c/2f928c0d5c02dbab49e8c19d98725c822f6fc409https://git.kernel.org/stable/c/473a66f99cb8173c14138c5a5c69bfad04e8f9achttps://git.kernel.org/stable/c/662893b4f6bd466ff9e1cd454c44c26d32d554fehttps://git.kernel.org/stable/c/6e7baf84149fb43950631415de231b3a41915aa3https://git.kernel.org/stable/c/7e0438f83dc769465ee663bb5dcf8cc154940712https://git.kernel.org/stable/c/a27ed2f3695baf15f9b34d2d7a1f9fc105539a81https://git.kernel.org/stable/c/cb64bd038beacb4331fe464a36c8b5481e8f51e2
2025-02-26
Published