CVE-2022-50044

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: qrtr: start MHI channel after endpoit creation

MHI channel may generates event/interrupt right after enabling.

It may leads to 2 race conditions issues.

1)

Such event may be dropped by qcom_mhi_qrtr_dl_callback() at check:

if (!qdev || mhi_res->transaction_status)

return;

Because dev_set_drvdata(&mhi_dev->dev, qdev) may be not performed at

this moment. In this situation qrtr-ns will be unable to enumerate

services in device.

---------------------------------------------------------------

2)

Such event may come at the moment after dev_set_drvdata() and

before qrtr_endpoint_register(). In this case kernel will panic with

accessing wrong pointer at qcom_mhi_qrtr_dl_callback():

rc = qrtr_endpoint_post(&qdev->ep, mhi_res->buf_addr,

mhi_res->bytes_xferd);

Because endpoint is not created yet.

--------------------------------------------------------------

So move mhi_prepare_for_transfer_autoqueue after en

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References