CVE-2022-49286
Description
In the Linux kernel, the following vulnerability has been resolved: tpm: use try_get_ops() in tpm-space.c As part of the series conversion to remove nested TPM operations: https://lore.kernel.org/all/[email protected]/ exposure of the chip->tpm_mutex was removed from much of the upper level code. In this conversion, tpm2_del_space() was missed. This didn't matter much because it's usually called closely after a converted operation, so there's only a very tiny race window where the chip can be removed before the space flushing is done which causes a NULL deref on the mutex. However, there are reports of this window being hit in practice, so fix this by converting tpm2_del_space() to use tpm_try_get_ops(), which performs all the teardown checks before acquring the mutex.
How to fix
- linux linux_kernel5.4.188, 5.10.109, 5.15.32, 5.16.18 or later
- git.kernel.org/stable/c/476ddd23f818fb94cf86fb5617f3bb9a7c92113d
- git.kernel.org/stable/c/5b1d2561a03e534064b51c50c774657833d3d2cf
- git.kernel.org/stable/c/95193d12f10a8a088843b25e0f5fe1d83ec6b079
- git.kernel.org/stable/c/ba84f9a48366dcc3cdef978599433efe101dd5bd
- git.kernel.org/stable/c/eda1662cce964c8a65bb86321f8d9cfa6e9ceaab
- git.kernel.org/stable/c/fb5abce6b2bb5cb3d628aaa63fa821da8c4600f9
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | 4.12 ≤ v < 5.4.188, 5.5 ≤ v < 5.10.109, 5.11 ≤ v < 5.15.32, 5.16 ≤ v < 5.16.18, 5.17 | 5.4.188, 5.10.109, 5.15.32, 5.16.18 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.