Critical Vulnerability in Linux Kernel: i2c Designware Interrupt Handling Issue
Summary
CVE-2022-50370: In the Linux kernel, the following vulnerability has been resolved: i2c: designware: Fix handling of real but unexpected device interrupts Commit c7b79a752871 ("mfd: intel-lpss: Add Intel Alder Lake PCH-S PCI IDs") cause... Affects linux versions < 6.0.3-1. Fixed in 6.0.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It is widely used in various distributions, including Debian. This vulnerability affects the i2c Designware driver, which is responsible for managing I2C (Inter-Integrated Circuit) devices. The issue arises during system resume from S3 sleep state, particularly on certain Gigabyte motherboards with Intel Alder Lake-S processors.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the i2c Designware driver, specifically related to the handling of unexpected device interrupts. This issue was introduced by a commit that caused a regression, leading to system crashes due to a NULL pointer dereference in the i2c_dw_xfer_msg() function when resuming from S3 sleep. The vulnerability can result in system instability and crashes, particularly affecting users with specific hardware configurations. The driver fails to manage interrupts correctly when the controller is unexpectedly active, leading to potential data corruption and system failures.
How To Fix
Minimum fixed version
6.0.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users experiencing issues can avoid resuming from S3 sleep state until the kernel is updated. Alternatively, users may consider disabling the i2c Designware driver if it is not essential for their system's operation.
Conclusion
The vulnerability in the Linux kernel's i2c Designware driver poses significant risks to system stability, particularly for users with specific hardware configurations. It is crucial to update to the patched version to mitigate these risks. Users should also consider using tools like Vulert to monitor for vulnerabilities in their software.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to system crashes and instability, particularly when resuming from S3 sleep state on affected hardware.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any installation.
Yes, updating to the patched version of the Linux kernel (6.0.3-1 or later) will permanently fix the vulnerability.
As a temporary measure, avoid resuming from S3 sleep state or consider disabling the i2c Designware driver if it is not critical for your system.
Detailed information can be found in the CVE database or through the Linux kernel mailing lists and documentation.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
