Critical UAF Vulnerability in Linux Kernel Affecting Debian Packages
Summary
CVE-2022-50190: In the Linux kernel, the following vulnerability has been resolved: spi: Fix simplification of devm_spi_register_controller This reverts commit 59ebbe40fb51 ("spi: simplify devm_spi_register_controller"). Affects linux versions < 6.0.2-1. Fixed in 6.0.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and hardware communication. It provides essential services for all other software running on the system. This vulnerability specifically affects the Debian packages of the Linux kernel, which are widely used in various distributions. The vulnerability arises from a flaw in the SPI (Serial Peripheral Interface) subsystem, which can lead to a use-after-free (UAF) condition, potentially compromising system stability and security.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the SPI subsystem, specifically in the devm_spi_register_controller function. The issue stems from a failure in the devm_add_action_or_reset function, which, if unsuccessful, triggers the devm_spi_unregister function. This function decreases the reference count of the controller device, leading to a use-after-free condition when drivers attempt to call spi_put_controller in the error path. This can result in undefined behavior, crashes, or exploitation by malicious actors.
How To Fix
Minimum fixed version
6.0.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating to the fixed version of the Linux kernel.
Conclusion
The identified vulnerability in the Linux kernel's SPI subsystem poses significant risks, including potential system instability and security breaches. It is crucial for users of Debian packages to update to the patched version 6.0.2-1 to mitigate these risks. Regular monitoring and prompt updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
A use-after-free vulnerability occurs when a program continues to use a memory reference after it has been freed, potentially leading to arbitrary code execution or crashes.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without any signup.
The consequences can include system crashes, data corruption, or exploitation by attackers to gain unauthorized access to the system.
Yes, this vulnerability affects specific versions of the Linux kernel, particularly those prior to the fixed version 6.0.2-1 in Debian 12 and 13.
If immediate updates are not possible, ensure that your system is secured by limiting access and monitoring for unusual activity until the update can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
