CVE-2022-50214

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

coresight: Clear the connection field properly

coresight devices track their connections (output connections) and

hold a reference to the fwnode. When a device goes away, we walk through

the devices on the coresight bus and make sure that the references

are dropped. This happens both ways:

a) For all output connections from the device, drop the reference to

the target device via coresight_release_platform_data()

b) Iterate over all the devices on the coresight bus and drop the

reference to fwnode if *this* device is the target of the output

connection, via coresight_remove_conns()->coresight_remove_match().

However, the coresight_remove_match() doesn't clear the fwnode field,

after dropping the reference, this causes use-after-free and

additional refcount drops on the fwnode.

e.g., if we have two devices, A and B, with a connection, A -> B.

If we remove B first, B would clear the reference on B, from A

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References