{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2022-49287", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-02-26T01:49:39.302Z", "datePublished": "2025-02-26T01:56:26.059Z", "dateUpdated": "2026-08-05T08:54:36.034Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:54:36.034Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntpm: fix reference counting for struct tpm_chip\n\nThe following sequence of operations results in a refcount warning:\n\n1. Open device /dev/tpmrm.\n2. Remove module tpm_tis_spi.\n3. Write a TPM command to the file descriptor opened at step 1.\n\n------------[ cut here ]------------\nWARNING: CPU: 3 PID: 1161 at lib/refcount.c:25 kobject_get+0xa0/0xa4\nrefcount_t: addition on 0; use-after-free.\nModules linked in: tpm_tis_spi tpm_tis_core tpm mdio_bcm_unimac brcmfmac\nsha256_generic libsha256 sha256_arm hci_uart btbcm bluetooth cfg80211 vc4\nbrcmutil ecdh_generic ecc snd_soc_core crc32_arm_ce libaes\nraspberrypi_hwmon ac97_bus snd_pcm_dmaengine bcm2711_thermal snd_pcm\nsnd_timer genet snd phy_generic soundcore [last unloaded: spi_bcm2835]\nCPU: 3 PID: 1161 Comm: hold_open Not tainted 5.10.0ls-main-dirty #2\nHardware name: BCM2711\n[] (unwind_backtrace) from [] (show_stack+0x10/0x14)\n[] (show_stack) from [] (dump_stack+0xc4/0xd8)\n[] (dump_stack) from [] (__warn+0x104/0x108)\n[] (__warn) from [] (warn_slowpath_fmt+0x74/0xb8)\n[] (warn_slowpath_fmt) from [] (kobject_get+0xa0/0xa4)\n[] (kobject_get) from [] (tpm_try_get_ops+0x14/0x54 [tpm])\n[] (tpm_try_get_ops [tpm]) from [] (tpm_common_write+0x38/0x60 [tpm])\n[] (tpm_common_write [tpm]) from [] (vfs_write+0xc4/0x3c0)\n[] (vfs_write) from [] (ksys_write+0x58/0xcc)\n[] (ksys_write) from [] (ret_fast_syscall+0x0/0x4c)\nException stack(0xc226bfa8 to 0xc226bff0)\nbfa0: 00000000 000105b4 00000003 beafe664 00000014 00000000\nbfc0: 00000000 000105b4 000103f8 00000004 00000000 00000000 b6f9c000 beafe684\nbfe0: 0000006c beafe648 0001056c b6eb6944\n---[ end trace d4b8409def9b8b1f ]---\n\nThe reason for this warning is the attempt to get the chip->dev reference\nin tpm_common_write() although the reference counter is already zero.\n\nSince commit 8979b02aaf1d (\"tpm: Fix reference count to main device\") the\nextra reference used to prevent a premature zero counter is never taken,\nbecause the required TPM_CHIP_FLAG_TPM2 flag is never set.\n\nFix this by moving the TPM 2 character device handling from\ntpm_chip_alloc() to tpm_add_char_device() which is called at a later point\nin time when the flag has been set in case of TPM2.\n\nCommit fdc915f7f719 (\"tpm: expose spaces via a device link /dev/tpmrm\")\nalready introduced function tpm_devs_release() to release the extra\nreference but did not implement the required put on chip->devs that results\nin the call of this function.\n\nFix this by putting chip->devs in tpm_chip_unregister().\n\nFinally move the new implementation for the TPM 2 handling into a new\nfunction to avoid multiple checks for the TPM_CHIP_FLAG_TPM2 flag in the\ngood case and error cases." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable path is a local character-device write on /dev/tpmrmN (tpmrm_open → tpm_common_write → tpm_try_get_ops → get_device), not reachable via network protocols or remote packet processing.\nAC:H - Triggering the UAF requires tpm_chip_unregister (e.g. rmmod/unbind of tpm_tis_spi) while the attacker still holds the FD; that teardown needs CAP_SYS_MODULE/admin and is outside the control of a tss-group opener, so success depends on a concurrent system state the attacker cannot initiate.\nPR:L - Opening/writing /dev/tpmrmN only requires access typically granted as 0660 tss:tss (udev), not real root/CAP_SYS_ADMIN; that is low privilege relative to init-namespace admin capabilities.\nUI:N - The attacker opens and writes their own FD; no separate victim action is required once the chip has been unregistered beneath that FD.\nS:U - Impact is use-after-free and potential privilege escalation inside the same host kernel authority; this is not a VM escape, IOMMU bypass, or other cross-boundary break.\nC:H - The bug is an explicit use-after-free of struct tpm_chip (refcount addition on 0), which enables reclaim/spray of the freed object and arbitrary kernel read primitives.\nI:H - The same tpm_chip UAF yields a corruptible kernel object for arbitrary write and control-flow hijacking via standard heap exploitation techniques.\nA:H - The UAF already produces a kernel warning/oops path on get_device after free and can crash the kernel even without a full exploit." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/char/tpm/tpm-chip.c", "drivers/char/tpm/tpm.h", "drivers/char/tpm/tpm2-space.c" ], "versions": [ { "version": "fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66", "lessThan": "473a66f99cb8173c14138c5a5c69bfad04e8f9ac", "status": "affected", "versionType": "git" }, { "version": "fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66", "lessThan": "cb64bd038beacb4331fe464a36c8b5481e8f51e2", "status": "affected", "versionType": "git" }, { "version": "fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66", "lessThan": "a27ed2f3695baf15f9b34d2d7a1f9fc105539a81", "status": "affected", "versionType": "git" }, { "version": "fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66", "lessThan": "290e05f346d1829e849662c97e42d5ad984f5258", "status": "affected", "versionType": "git" }, { "version": "fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66", "lessThan": "662893b4f6bd466ff9e1cd454c44c26d32d554fe", "status": "affected", "versionType": "git" }, { "version": "fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66", "lessThan": "2f928c0d5c02dbab49e8c19d98725c822f6fc409", "status": "affected", "versionType": "git" }, { "version": "fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66", "lessThan": "6e7baf84149fb43950631415de231b3a41915aa3", "status": "affected", "versionType": "git" }, { "version": "fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66", "lessThan": "7e0438f83dc769465ee663bb5dcf8cc154940712", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/char/tpm/tpm-chip.c", "drivers/char/tpm/tpm.h", "drivers/char/tpm/tpm2-space.c" ], "versions": [ { "version": "4.12", "status": "affected" }, { "version": "0", "lessThan": "4.12", "status": "unaffected", "versionType": "semver" }, { "version": "4.14.276", "lessThanOrEqual": "4.14.*", "status": "unaffected", "versionType": "semver" }, { "version": "4.19.238", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.189", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.110", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.33", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.16.19", "lessThanOrEqual": "5.16.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.17.1", "lessThanOrEqual": "5.17.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "4.14.276" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "4.19.238" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "5.4.189" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "5.10.110" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "5.15.33" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "5.16.19" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "5.17.1" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "5.18" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/473a66f99cb8173c14138c5a5c69bfad04e8f9ac" }, { "url": "https://git.kernel.org/stable/c/cb64bd038beacb4331fe464a36c8b5481e8f51e2" }, { "url": "https://git.kernel.org/stable/c/a27ed2f3695baf15f9b34d2d7a1f9fc105539a81" }, { "url": "https://git.kernel.org/stable/c/290e05f346d1829e849662c97e42d5ad984f5258" }, { "url": "https://git.kernel.org/stable/c/662893b4f6bd466ff9e1cd454c44c26d32d554fe" }, { "url": "https://git.kernel.org/stable/c/2f928c0d5c02dbab49e8c19d98725c822f6fc409" }, { "url": "https://git.kernel.org/stable/c/6e7baf84149fb43950631415de231b3a41915aa3" }, { "url": "https://git.kernel.org/stable/c/7e0438f83dc769465ee663bb5dcf8cc154940712" } ], "title": "tpm: fix reference counting for struct tpm_chip", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH" } }, { "other": { "type": "ssvc", "content": { "id": "CVE-2022-49287", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "version": "2.0.3", "timestamp": "2025-02-27T18:16:50.967565Z" } } } ], "problemTypes": [ { "descriptions": [ { "lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free" } ] } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-27T18:22:34.163Z" } } ] } }