Flow Release Count Overflow in Linux Kernel - CVE-2022-49820
Summary
CVE-2022-49820: In the Linux kernel, the following vulnerability has been resolved: mctp i2c: don't count unused / invalid keys for flow release We're currently hitting the WARN_ON in mctp_i2c_flow_release: if (midev->release_count > mi... Affects linux versions < 6.0.10-1. Fixed in 6.0.10-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It is known for its stability, performance, and security features. However, like any complex software, it can have vulnerabilities. CVE-2022-49820 specifically affects the MCTP (Management Component Transport Protocol) implementation over I2C (Inter-Integrated Circuit), which is used for communication between devices in embedded systems. This vulnerability can lead to improper flow management, potentially causing system instability.
Vulnerability Detail
CVE-2022-49820 arises from a flaw in the MCTP I2C flow release mechanism within the Linux kernel. The issue occurs when the release count of a flow exceeds the I2C lock count, leading to a WARN_ON condition. This situation may happen if a flow is expired before any packets are sent, resulting in an overflow of the release count. The ramifications include potential system crashes or unexpected behavior in devices relying on this protocol, as the flow management becomes inconsistent.
How To Fix
Minimum fixed version
6.0.10-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
CVE-2022-49820 is a significant vulnerability in the Linux kernel that can lead to flow management issues in MCTP over I2C. Users are advised to update their systems to the latest patched version to ensure stability and security. Monitoring tools like Vulert can assist in identifying vulnerabilities in your applications.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49820 is a vulnerability in the Linux kernel's MCTP I2C implementation that can lead to a flow release count overflow.
This vulnerability can cause system instability and unexpected behavior in devices that utilize the MCTP protocol over I2C.
You should update your Linux kernel to version 6.0.10-1 or later to mitigate the risk associated with this vulnerability.
Yes, you can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
