Critical Vulnerability in Linux Kernel: IOMMU Clock Control Issue
Summary
CVE-2022-49427: In the Linux kernel, the following vulnerability has been resolved: iommu/mediatek: Remove clk_disable in mtk_iommu_remove After the commit b34ea31fe013 ("iommu/mediatek: Always enable the clk on resume"), the iommu cloc... Affects linux versions < 5.18.5-1. Fixed in 5.18.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It is known for its stability, performance, and extensive support for various hardware architectures. However, it is also susceptible to vulnerabilities that can affect system performance and security. The specific vulnerability in question relates to the IOMMU (Input-Output Memory Management Unit) clock control, which can lead to system warnings and potential instability.
Vulnerability Detail
In the Linux kernel, a vulnerability was identified in the Mediatek IOMMU driver, specifically in the mtk_iommu_remove function. After a specific commit, the IOMMU clock is controlled by a runtime callback, which means that the previous manual clock control in the removal function is no longer necessary. Failing to remove this clock control can lead to warnings when unbinding the driver, indicating that the clock is already disabled. This can cause confusion and may lead to further issues in system stability and performance.
How To Fix
Minimum fixed version
5.18.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating the kernel package as described above.
Conclusion
The CVE-2022-49427 vulnerability in the Linux kernel highlights an important issue with IOMMU clock control that can lead to system warnings. Users are advised to update their kernel to the fixed version to ensure system stability and performance. Utilizing tools like Vulert can help in monitoring for such vulnerabilities in the future.
See every vulnerability recorded for linux →
FAQ
The impact includes system warnings related to clock control when unbinding the IOMMU driver, which may lead to confusion and potential instability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
While this vulnerability primarily causes warnings and may affect system performance, it does not directly indicate a risk of data loss.
If an immediate update is not possible, monitor your system for any unusual behavior and plan to apply the patch as soon as feasible.
Detailed information can be found in the official CVE database and through the Linux kernel mailing lists where such vulnerabilities are discussed.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
