CVE-2022-49287

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tpm: fix reference counting for struct tpm_chip

The following sequence of operations results in a refcount warning:

1. Open device /dev/tpmrm.

2. Remove module tpm_tis_spi.

3. Write a TPM command to the file descriptor opened at step 1.

------------[ cut here ]------------

WARNING: CPU: 3 PID: 1161 at lib/refcount.c:25 kobject_get+0xa0/0xa4

refcount_t: addition on 0; use-after-free.

Modules linked in: tpm_tis_spi tpm_tis_core tpm mdio_bcm_unimac brcmfmac

sha256_generic libsha256 sha256_arm hci_uart btbcm bluetooth cfg80211 vc4

brcmutil ecdh_generic ecc snd_soc_core crc32_arm_ce libaes

raspberrypi_hwmon ac97_bus snd_pcm_dmaengine bcm2711_thermal snd_pcm

snd_timer genet snd phy_generic soundcore [last unloaded: spi_bcm2835]

CPU: 3 PID: 1161 Comm: hold_open Not tainted 5.10.0ls-main-dirty #2

Hardware name: BCM2711

[<c0410c3c>] (unwind_backtrace) from [<c040b580>] (show_stack+0x10/0x14)

[<c040b580>] (show_stack) from [

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References