Runtime PM Underflow Vulnerability in Linux Kernel - CVE-2022-49650
Summary
CVE-2022-49650: In the Linux kernel, the following vulnerability has been resolved: dmaengine: qcom: bam_dma: fix runtime PM underflow Commit dbad41e7bb5f ("dmaengine: qcom: bam_dma: check if the runtime pm enabled") caused unbalanced p... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, managing hardware resources and providing essential services for software applications. It is known for its robustness, flexibility, and extensive support for various hardware architectures. However, like any complex software, it is susceptible to vulnerabilities that can impact system stability and security. CVE-2022-49650 specifically affects the DMA engine for Qualcomm's BAM (Bus Access Management), which is responsible for efficient data transfer between devices.
Vulnerability Detail
CVE-2022-49650 is a vulnerability in the Linux kernel that arises from unbalanced runtime PM (power management) calls in the BAM DMA engine. This issue was introduced by a commit that failed to properly check if runtime PM was enabled when the BAM is controlled remotely. The consequence of this oversight can lead to a runtime PM underflow, potentially causing system instability or unexpected behavior when managing power states. The vulnerability has been addressed by reverting the problematic commit and ensuring that runtime PM is enabled in all scenarios, while also cleaning up unnecessary null checks.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating to the fixed version of the Linux kernel.
Conclusion
CVE-2022-49650 is a significant vulnerability in the Linux kernel that affects the BAM DMA engine's power management functionality. Users are advised to update their systems to the patched version to ensure stability and security. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49650 is a vulnerability in the Linux kernel related to unbalanced runtime PM calls in the BAM DMA engine, which can lead to system instability.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
The vulnerability can cause runtime PM underflow, leading to unexpected behavior and instability in systems that rely on the BAM DMA engine for power management.
Yes, a patch is available. Users should update their Linux kernel to version 5.18.14-1 or later to mitigate the vulnerability.
You can update your Linux kernel by running 'sudo apt-get update && sudo apt-get install linux=5.18.14-1' in your terminal. Make sure to check your current kernel version first.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
