Kernel Panic Fix in Linux Package: Addressing CVE-2022-49192 Vulnerability
Summary
CVE-2022-49192: In the Linux kernel, the following vulnerability has been resolved: drivers: ethernet: cpsw: fix panic when interrupt coaleceing is set via ethtool cpsw_ethtool_begin directly returns the result of pm_runtime_get_sync wh... Affects linux versions < 5.17.3-1. Fixed in 5.17.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to software applications. It is widely used across various platforms, from servers to embedded systems. The kernel's stability and security are paramount, as vulnerabilities can lead to system crashes, data loss, or unauthorized access. This specific vulnerability, CVE-2022-49192, affects the Ethernet driver for the CPSW (Common Platform Switch) and can cause kernel panics under certain conditions.
Vulnerability Detail
CVE-2022-49192 arises from improper handling of device power management in the CPSW Ethernet driver. The function cpsw_ethtool_begin incorrectly returns the result of pm_runtime_get_sync, which can lead to inconsistent calls to pm_runtime_put. This inconsistency results in the CPSW device being left in a suspended state, causing access violations when other parts of the driver attempt to interact with it. The vulnerability can lead to system instability and crashes, particularly when interrupt coalescing is enabled via ethtool.
How To Fix
Minimum fixed version
5.17.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workaround is mentioned for this vulnerability. However, users can disable interrupt coalescing as a temporary measure until the package is updated.
Conclusion
CVE-2022-49192 is a significant vulnerability in the Linux kernel's CPSW Ethernet driver that can lead to system crashes. It is crucial to update to the patched version 5.17.3-1 to ensure system stability and security. Users should also consider using tools like Vulert to monitor for vulnerabilities in their software.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49192 is a vulnerability in the Linux kernel's CPSW Ethernet driver that can lead to kernel panics due to improper power management handling.
This vulnerability can cause system instability and crashes, particularly when using the CPSW Ethernet driver with interrupt coalescing enabled.
Yes, the vulnerability has been patched in version 5.17.3-1 of the Linux package for Debian 12 and 13.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
As a temporary measure, consider disabling interrupt coalescing to mitigate the risk of kernel panics until you can apply the patch.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
