ACPI Companion Misassignment in Linux Kernel - CVE-2022-49306
Summary
CVE-2022-49306: In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: host: Stop setting the ACPI companion It is no longer needed. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, including Debian. It manages hardware resources and provides essential services for software applications. The kernel's USB subsystem, specifically the DWC3 driver, is responsible for managing USB devices. This vulnerability arises from an incorrect assignment of ACPI companions, which can lead to unintended side effects.
Vulnerability Detail
CVE-2022-49306 is a vulnerability in the Linux kernel's USB DWC3 host driver. The issue stems from the unnecessary assignment of the ACPI companion to the DWC3 device, which inadvertently alters the fwnode->secondary pointer for the parent device. This misassignment can lead to resource leaks and other potential side effects, impacting system stability and performance.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, no specific workaround is provided for this vulnerability. It is recommended to apply the patch as soon as it is available.
Conclusion
CVE-2022-49306 is a significant vulnerability in the Linux kernel's USB subsystem that can lead to resource leaks and system instability. It is essential to update to the patched version to ensure system security and performance. Utilize tools like Vulert for real-time monitoring of vulnerabilities in your applications.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49306 is a vulnerability in the Linux kernel related to the USB DWC3 host driver, caused by incorrect assignment of ACPI companions.
This vulnerability can lead to resource leaks and potentially impact system stability and performance.
Yes, the patched version for Debian 12 and 13 is 5.18.5-1. It is recommended to update to this version.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without signup.
While no specific workaround is provided, it is crucial to monitor for updates and apply them as soon as possible to mitigate risks.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
