CVE-2022-50260

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/msm: Make .remove and .shutdown HW shutdown consistent

Drivers' .remove and .shutdown callbacks are executed on different code

paths. The former is called when a device is removed from the bus, while

the latter is called at system shutdown time to quiesce the device.

This means that some overlap exists between the two, because both have to

take care of properly shutting down the hardware. But currently the logic

used in these two callbacks isn't consistent in msm drivers, which could

lead to kernel panic.

For example, on .remove the component is deleted and its .unbind callback

leads to the hardware being shutdown but only if the DRM device has been

marked as registered.

That check doesn't exist in the .shutdown logic and this can lead to the

driver calling drm_atomic_helper_shutdown() for a DRM device that hasn't

been properly initialized.

A situation like this can happen if drivers for expected sub-devices

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References