UAF Vulnerability in Linux Kernel's SPI Controller - CVE-2022-50192
Summary
CVE-2022-50192: In the Linux kernel, the following vulnerability has been resolved: spi: tegra20-slink: fix UAF in tegra_slink_remove() After calling spi_unregister_master(), the refcount of master will be decrease to 0, and it will be... Affects linux versions < 6.0.2-1. Fixed in 6.0.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interactions. It includes various subsystems, one of which is the SPI (Serial Peripheral Interface) controller, allowing communication between the CPU and peripheral devices. The vulnerability in question arises from improper handling of reference counts in the SPI controller, specifically in the tegra20-slink driver, leading to potential use-after-free (UAF) conditions.
Vulnerability Detail
CVE-2022-50192 is a use-after-free vulnerability found in the tegra_slink_remove() function of the SPI controller within the Linux kernel. This issue occurs when the spi_unregister_master() function is called, which decreases the reference count of the master to zero and subsequently frees it. If the device data is accessed after this point, it can lead to undefined behavior, crashes, or exploitation by malicious actors. The vulnerability is particularly concerning as it can compromise system stability and security.
How To Fix
Minimum fixed version
6.0.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating to the fixed version of the Linux package.
Conclusion
CVE-2022-50192 represents a significant vulnerability in the Linux kernel's SPI controller, necessitating prompt action to update affected systems. By applying the recommended patch, users can safeguard their systems against potential exploitation and ensure continued stability.
See every vulnerability recorded for linux →
FAQ
CVE-2022-50192 is a use-after-free vulnerability in the Linux kernel's SPI controller, which can lead to system instability and security risks.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The vulnerability can lead to crashes, undefined behavior, or exploitation by attackers, compromising system security and stability.
Yes, a patch is available in version 6.0.2-1 of the Linux package. It is recommended to update to this version or later.
While there are no specific workarounds, it is crucial to prioritize updating your system to mitigate the risks associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
