CVE-2022-50491: In the Linux kernel, the following vulnerability has been resolved: coresight: cti: Fix hang in cti_disable_hw() cti_enable_hw() and cti_disable_hw() are…

PriorityP420medium5.5CVSS 3.1

AVLACLPRLUINSUCNINAH

EPSS

0.14%

4.2th percentile

In the Linux kernel, the following vulnerability has been resolved: coresight: cti: Fix hang in cti_disable_hw() cti_enable_hw() and cti_disable_hw() are called from an atomic context so shouldn't use runtime PM because it can result in a sleep when communicating with firmware. Since commit 3c6656337852 ("Revert "firmware: arm_scmi: Add clock management to the SCMI power domain""), this causes a hang on Juno when running the Perf Coresight tests or running this command: perf record -e cs_etm//u -- ls This was also missed until the revert commit because pm_runtime_put() was called with the wrong device until commit 692c9a499b28 ("coresight: cti: Correct the parameter for pm_runtime_put") With lock and scheduler debugging enabled the following is output: coresight cti_sys0: cti_enable_hw -- dev:cti_sys0 parent: 20020000.cti BUG: sleeping function called from invalid context at drivers/base/power/runtime.c:1151 in_atomic(): 1, irqs_disabled(): 128, non_block: 0, pid: 330, name: perf-exec preempt_count: 2, expected: 0 RCU nest depth: 0, expected: 0 INFO: lockdep is turned off. irq event stamp: 0 hardirqs last enabled at (0): [] 0x0 hardirqs last disabled at (0): [] copy_process+0xa0c/0x1948 softirqs last enabled at (0): [] copy_process+0xa0c/0x1948 softirqs last disabled at (0): [] 0x0 CPU: 3 PID: 330 Comm: perf-exec Not tainted 6.0.0-00053-g042116d99298 #7 Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development Platform, BIOS EDK II Sep 13 2022 Call trace: dump_backtrace+0x134/0x140 show_stack+0x20/0x58 dump_stack_lvl+0x8c/0xb8 dump_stack+0x18/0x34 __might_resched+0x180/0x228 __might_sleep+0x50/0x88 __pm_runtime_resume+0xac/0xb0 cti_enable+0x44/0x120 coresight_control_assoc_ectdev+0xc0/0x150 coresight_enable_path+0xb4/0x288 etm_event_start+0x138/0x170 etm_event_add+0x48/0x70 event_sched_in.isra.122+0xb4/0x280 merge_sched_in+0x1fc/0x3d0 visit_groups_merge.constprop.137+0x16c/0x4b0 ctx_sched_in+0x114/0x1f0 perf_event_sched_in+0x60/0x90 ctx_resche

Affected

14 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 6.0.7-1 (bookworm)	linux 6.0.7-1 (bookworm)
linux	linux	—	—
linux	linux	>= 835d722ba10ac924adba1e8a46f2d80955222b4b < e33ce54cef5d429430e3b1ae5c8ee4f4103c4fdc	e33ce54cef5d429430e3b1ae5c8ee4f4103c4fdc
linux	linux	>= 835d722ba10ac924adba1e8a46f2d80955222b4b < 4c365a0c21aaf2b8fcc88de8dc298803288f61ac	4c365a0c21aaf2b8fcc88de8dc298803288f61ac
linux	linux	>= 835d722ba10ac924adba1e8a46f2d80955222b4b < c51cfba50df8b9e16bfe0e6d4f2f252a4a10063d	c51cfba50df8b9e16bfe0e6d4f2f252a4a10063d
linux	linux	>= 835d722ba10ac924adba1e8a46f2d80955222b4b < 6746eae4bbaddcc16b40efb33dab79210828b3ce	6746eae4bbaddcc16b40efb33dab79210828b3ce
linux	linux_kernel	—	—
linux	linux_kernel	>= 0 < 5.10.158-1	5.10.158-1
linux	linux_kernel	>= 0 < 6.0.7-1	6.0.7-1
linux	linux_kernel	>= 0 < 6.0.7-1	6.0.7-1
linux	linux_kernel	>= 0 < 6.0.7-1	6.0.7-1
linux	linux_kernel	>= 5.11 < 5.15.77	5.15.77
linux	linux_kernel	>= 5.16 < 6.0.7	6.0.7
linux	linux_kernel	>= 5.7 < 5.10.154	5.10.154

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

osv5.5MEDIUM

vendor_debian5.5MEDIUM

vendor_redhat5.5MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.