Vulnerability in Kernel: tpm: fix reference counting for struct tpm_chip
Summary
GSD-2022-1002145: tpm: fix reference counting for struct tpm_chip. Affects Kernel versions >= fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66, < 290e05f346d1829e849662c97e42d5ad984f5258. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that manages communication between hardware and software. It provides essential functions and services to enable the proper functioning of the system. The tpm_chip structure is part of the Trusted Platform Module (TPM) subsystem in the Kernel, which handles interactions with TPM hardware devices. The TPM is a hardware-based security feature that provides cryptographic functions and secure storage. This vulnerability affects the reference counting mechanism for the tpm_chip structure, potentially leading to security issues.
Vulnerability Detail
The vulnerability arises from a flaw in the reference counting implementation for the struct tpm_chip in the Kernel. The issue was introduced in version v4.12 and fixed in version v5.10.110. Attackers may exploit this vulnerability to manipulate reference counts, leading to memory corruption or use-after-free vulnerabilities. The impact and attack plausibility of this vulnerability have not been proven yet. It is crucial to update to the fixed version to mitigate any potential risks.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The vulnerability in the Kernel's tpm_chip reference counting mechanism can potentially lead to memory corruption or use-after-free vulnerabilities. It is crucial to update to the fixed version of the Linux Kernel (v5.10.110 or later) to mitigate any potential risks. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is not yet proven, but it could potentially lead to memory corruption or use-after-free vulnerabilities.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will provide real-time monitoring and alerts for open-source vulnerabilities.
No specific workaround has been provided for this vulnerability. It is recommended to update to the fixed version of the Linux Kernel.
The remote exploitability of this vulnerability has not been determined yet. However, it is always advisable to keep systems up to date with the latest security patches.
You can find more information about this vulnerability in the Open Source Vulnerability Database (OSVDB) entry: https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1002xxx/GSD-2022-1002145.json
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
