CVE-2022-50202

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

PM: hibernate: defer device probing when resuming from hibernation

syzbot is reporting hung task at misc_open() [1], for there is a race

window of AB-BA deadlock which involves probe_count variable. Currently

wait_for_device_probe() from snapshot_open() from misc_open() can sleep

forever with misc_mtx held if probe_count cannot become 0.

When a device is probed by hub_event() work function, probe_count is

incremented before the probe function starts, and probe_count is

decremented after the probe function completed.

There are three cases that can prevent probe_count from dropping to 0.

(a) A device being probed stopped responding (i.e. broken/malicious

hardware).

(b) A process emulating a USB device using /dev/raw-gadget interface

stopped responding for some reason.

(c) New device probe requests keeps coming in before existing device

probe requests complete.

The phenomenon syzbot is repo

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References