Log in Start free

Vulnerability · Published Oct 21, 2024 · Assigned by Linux

CVE-2022-48997char: tpm: Protect tpm_pm_suspend with locks

Medium 4.7

In plain English

A medium-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)4.7Medium
Exploit odds (30 days)0.2%top 85.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: char: tpm: Protect tpm_pm_suspend with locks Currently tpm transactions are executed unconditionally in tpm_pm_suspend() function, which may lead to races with other tpm accessors in the system. Specifically, the hw_random tpm driver makes use of tpm_get_random(), and this function is called in a loop from a kthread, which means it's not frozen alongside userspace, and so can race with the work done during system suspend: tpm tpm0: tpm_transmit: tpm_recv: error -52 tpm tpm0: invalid TPM_STS.x 0xff, dumping stack for forensics CPU: 0 PID: 1 Comm: init Not tainted 6.1.0-rc5+ #135 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-20220807_005459-localhost 04/01/2014 Call Trace: tpm_tis_status.cold+0x19/0x20 tpm_transmit+0x13b/0x390 tpm_transmit_cmd+0x20/0x80 tpm1_pm_suspend+0xa6/0x110 tpm_pm_suspend+0x53/0x80 __pnp_bus_suspend+0x35/0xe0 __device_suspend+0x10f/0x350 Fix this by calling tpm_try_get_ops(), which itself is a wrapper around tpm_chip_start(), but takes the appropriate mutex. [Jason: reworked commit message, added metadata]

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.0.12-1DEBIAN-CVE-2022-48997
Debian:13linux6.0.12-1DEBIAN-CVE-2022-48997
Debian:14linux6.0.12-1DEBIAN-CVE-2022-48997
Ubuntu:22.04:LTSlinux5.15.0-67.74UBUNTU-CVE-2022-48997
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2022-48997
Ubuntu:22.04:LTSlinux-aws5.15.0-1031.35UBUNTU-CVE-2022-48997
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2022-48997
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2022-48997
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2022-48997
Ubuntu:22.04:LTSlinux-azure5.15.0-1034.41UBUNTU-CVE-2022-48997
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2022-48997
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2022-48997
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2022-48997
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1034.41.1UBUNTU-CVE-2022-48997
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2022-48997
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2022-48997
Ubuntu:22.04:LTSlinux-gcp5.15.0-1030.37UBUNTU-CVE-2022-48997
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2022-48997
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2022-48997
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2022-48997
Ubuntu:22.04:LTSlinux-gke5.15.0-1028.33UBUNTU-CVE-2022-48997
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1016.21UBUNTU-CVE-2022-48997
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2022-48997
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2022-48997
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2022-48997
Ubuntu:22.04:LTSlinux-ibm5.15.0-1026.29UBUNTU-CVE-2022-48997
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1026.31UBUNTU-CVE-2022-48997
Ubuntu:22.04:LTSlinux-kvm5.15.0-1029.34UBUNTU-CVE-2022-48997
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-67.74UBUNTU-CVE-2022-48997
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2022-48997
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2022-48997
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2022-48997
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1023.23UBUNTU-CVE-2022-48997
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2022-48997
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2022-48997
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2022-48997
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2022-48997
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2022-48997
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2022-48997
Ubuntu:22.04:LTSlinux-oracle5.15.0-1030.36UBUNTU-CVE-2022-48997
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2022-48997
Ubuntu:22.04:LTSlinux-raspi5.15.0-1025.27UBUNTU-CVE-2022-48997
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2022-48997
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2022-48997
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2022-48997
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2022-48997
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2022-48997
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2022-48997
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2022-48997
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2022-48997

Affected products (as reported)

VendorProductVersions
Linux Linux e891db1a18bf11e02533ec2386b796cfd8d60666 – before d699373ac5f3545243d3c73a1ccab77fdef8cec6e891db1a18bf11e02533ec2386b796cfd8d60666 – before 4e0d6c687c925e27fd4bc78a2721d10acf5614d6e891db1a18bf11e02533ec2386b796cfd8d60666 – before 571b6bbbf54d835ea6120f65575cb55cd767e603e891db1a18bf11e02533ec2386b796cfd8d60666 – before 25b78bf98b07ff5aceb9b1e24f72ec0236c5c053e891db1a18bf11e02533ec2386b796cfd8d60666 – before 23393c6461422df5bf8084a086ada9a7e17dc2ba
Linux Linux 5.1

References