CVE-2022-49753

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: Fix double increment of client_count in dma_chan_get()

The first time dma_chan_get() is called for a channel the channel

client_count is incorrectly incremented twice for public channels,

first in balance_ref_count(), and again prior to returning. This

results in an incorrect client count which will lead to the

channel resources not being freed when they should be. A simple

test of repeated module load and unload of async_tx on a Dell

Power Edge R7425 also shows this resulting in a kref underflow

warning.

[ 124.329662] async_tx: api initialized (async)

[ 129.000627] async_tx: api initialized (async)

[ 130.047839] ------------[ cut here ]------------

[ 130.052472] refcount_t: underflow; use-after-free.

[ 130.057279] WARNING: CPU: 3 PID: 19364 at lib/refcount.c:28

refcount_warn_saturate+0xba/0x110

[ 130.065811] Modules linked in: async_tx(-) rfkill intel_rapl_msr

intel_rapl_common amd64_edac edac_m

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References