Race Condition Vulnerability in Linux Kernel's QRTR MHI Channel Handling
Summary
CVE-2022-50044: In the Linux kernel, the following vulnerability has been resolved: net: qrtr: start MHI channel after endpoit creation MHI channel may generates event/interrupt right after enabling. Affects linux versions < 6.0.2-1. Fixed in 6.0.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interactions. It is known for its stability, performance, and extensive support for various hardware architectures. The QRTR (Qualcomm Remote Procedure Call Transport) is a subsystem within the kernel that facilitates communication between different components in Qualcomm-based systems. This vulnerability affects the QRTR subsystem, specifically in the handling of MHI (Mobile Host Interface) channels, which are crucial for managing data transfers and events.
Vulnerability Detail
In the Linux kernel, a race condition vulnerability has been identified in the QRTR subsystem related to MHI channel management. This issue arises when an event or interrupt is generated immediately after enabling the MHI channel, leading to two potential race conditions. The first condition occurs when the event is dropped due to the device data not being set, preventing the enumeration of services. The second condition can cause a kernel panic when accessing an uninitialized pointer, resulting in system instability. This vulnerability can compromise the reliability of services and potentially lead to system crashes.
How To Fix
Minimum fixed version
6.0.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds are provided for this vulnerability. It is advisable to apply the patch as soon as it is available to mitigate the risks associated with the race conditions.
Conclusion
The CVE-2022-50044 vulnerability in the Linux kernel's QRTR subsystem poses significant risks due to race conditions that can lead to system instability. It is essential to update to the patched version to ensure the reliability and security of your system. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2022-50044 is a vulnerability in the Linux kernel's QRTR subsystem that can lead to race conditions and potential system crashes.
This vulnerability can cause instability in systems using the Linux kernel, particularly those relying on Qualcomm hardware for communication.
Yes, a patch is available in the form of Linux version 6.0.2-1 or later. Updating to this version will resolve the vulnerability.
Yes, you can use Vulert, which monitors open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup.
While there are no specific workarounds, it is crucial to prioritize updating your kernel to mitigate the risks associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
