Kernel Crash on Suspend Due to Missing Board File in Linux Package
Summary
CVE-2022-49132: In the Linux kernel, the following vulnerability has been resolved: ath11k: pci: fix crash on suspend if board file is not found Mario reported that the kernel was crashing on suspend if ath11k was not able to find a boa... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and hardware communication. It supports a wide range of hardware and is known for its stability and performance. The ath11k driver, part of the Linux kernel, is specifically designed for Qualcomm Atheros 11k wireless devices, enabling efficient wireless communication. However, a vulnerability has been identified that causes the kernel to crash during the suspend process if the ath11k driver cannot locate the necessary board file.
Vulnerability Detail
The vulnerability, identified as CVE-2022-49132, arises when the ath11k driver attempts to suspend the system without having successfully loaded the required board file. This leads to a page fault error in kernel mode, resulting in a system crash. The issue is exacerbated by the asynchronous nature of the ath11k initialization process, which allows the suspend handler to be enabled even when the driver is not fully initialized. The technical details indicate that the crash occurs due to an attempt to access a non-present page in memory, leading to a supervisor read access violation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid suspending the system while using the ath11k driver until the kernel is updated. Additionally, users can disable the ath11k driver if it is not needed, which can prevent the crash from occurring.
Conclusion
CVE-2022-49132 is a critical vulnerability in the Linux kernel affecting the ath11k driver, leading to system crashes during suspend operations. Users are advised to update their kernels to the latest patched versions to mitigate this risk. Temporary workarounds are available, but updating is the most effective solution.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49132 is a vulnerability in the Linux kernel that causes a crash during system suspend if the ath11k driver cannot find the required board file.
If your system uses the ath11k driver and attempts to suspend without the necessary board file, it may crash, leading to potential data loss or system instability.
Yes, the vulnerability has been addressed in the patched versions of the Linux kernel, specifically 5.17.3-1 for Debian 12 and 13.
As a temporary measure, avoid suspending your system while using the ath11k driver or consider disabling the driver if it is not essential.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By uploading a manifest file like package-lock.json to the Vulert playground, you can check for vulnerabilities without needing to install any software.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
