CVE-2022-49613

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

serial: 8250: Fix PM usage_count for console handover

When console is enabled, univ8250_console_setup() calls

serial8250_console_setup() before .dev is set to uart_port. Therefore,

it will not call pm_runtime_get_sync(). Later, when the actual driver

is going to take over univ8250_console_exit() is called. As .dev is

already set, serial8250_console_exit() makes pm_runtime_put_sync() call

with usage count being zero triggering PM usage count warning

(extra debug for univ8250_console_setup(), univ8250_console_exit(), and

serial8250_register_ports()):

[ 0.068987] univ8250_console_setup ttyS0 nodev

[ 0.499670] printk: console [ttyS0] enabled

[ 0.717955] printk: console [ttyS0] printing thread started

[ 1.960163] serial8250_register_ports assigned dev for ttyS0

[ 1.976830] printk: console [ttyS0] disabled

[ 1.976888] printk: console [ttyS0] printing thread stopped

[ 1.977073] univ8250_console_exit tt

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References