Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

fstec логотип

BDU:2026-01395

Опубликовано: 10 мар. 2022
Источник: fstec
CVSS3: 4.7
CVSS2: 3.8
EPSS Низкий

Описание

Уязвимость функции tpm2_init_space() модуля drivers/char/tpm/tpm2-space.c драйвера поддержки алфавитноцифровых устройств с TPM ядра операционной системы Linux связана с разыменованием нулевого указателя. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании

Вендор

Сообщество свободного программного обеспечения
Red Hat Inc.

Наименование ПО

Debian GNU/Linux
Red Hat Enterprise Linux
Linux

Версия ПО

11 (Debian GNU/Linux)
9 (Red Hat Enterprise Linux)
от 5.5 до 5.10.108 включительно (Linux)
от 5.11 до 5.15.31 включительно (Linux)
от 5.16 до 5.16.17 включительно (Linux)
5.17 (Linux)
от 4.12 до 5.4.187 включительно (Linux)

Тип ПО

Операционная система

Операционные системы и аппаратные платформы

Сообщество свободного программного обеспечения Debian GNU/Linux 11
Red Hat Inc. Red Hat Enterprise Linux 9
Сообщество свободного программного обеспечения Linux от 5.5 до 5.10.108 включительно
Сообщество свободного программного обеспечения Linux от 5.11 до 5.15.31 включительно
Сообщество свободного программного обеспечения Linux от 5.16 до 5.16.17 включительно
Сообщество свободного программного обеспечения Linux 5.17
Сообщество свободного программного обеспечения Linux от 4.12 до 5.4.187 включительно

Уровень опасности уязвимости

Низкий уровень опасности (базовая оценка CVSS 2.0 составляет 3,8)
Средний уровень опасности (базовая оценка CVSS 3.1 составляет 4,7)

Возможные меры по устранению уязвимости

В условиях отсутствия обновлений безопасности от производителя рекомендуется придерживаться "Рекомендаций по безопасной настройке операционных систем LINUX", изложенных в методическом документе ФСТЭК России, утверждённом 25 декабря 2022 года.
Использование рекомендаций:
Для Linux:
https://lore.kernel.org/linux-cve-announce/2025022632-CVE-2022-49286-a585@gregkh/
https://git.kernel.org/linus/fb5abce6b2bb5cb3d628aaa63fa821da8c4600f9
https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.188
https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.109
https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.32
https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.18
https://git.kernel.org/stable/c/95193d12f10a8a088843b25e0f5fe1d83ec6b079
https://git.kernel.org/stable/c/5b1d2561a03e534064b51c50c774657833d3d2cf
https://git.kernel.org/stable/c/ba84f9a48366dcc3cdef978599433efe101dd5bd
https://git.kernel.org/stable/c/eda1662cce964c8a65bb86321f8d9cfa6e9ceaab
https://git.kernel.org/stable/c/476ddd23f818fb94cf86fb5617f3bb9a7c92113d
Для Debian GNU/Linux:
https://security-tracker.debian.org/tracker/CVE-2022-49286
Для продуктов Red Hat Inc.:
https://access.redhat.com/security/cve/cve-2022-49286

Статус уязвимости

Подтверждена производителем

Наличие эксплойта

Данные уточняются

Информация об устранении

Уязвимость устранена

Идентификаторы других систем описаний уязвимостей

EPSS

Процентиль: 14%
0.00234
Низкий

4.7 Medium

CVSS3

3.8 Low

CVSS2

Связанные уязвимости

CVSS3: 4.7
ubuntu
больше 1 года назад

In the Linux kernel, the following vulnerability has been resolved: tpm: use try_get_ops() in tpm-space.c As part of the series conversion to remove nested TPM operations: https://lore.kernel.org/all/20190205224723.19671-1-jarkko.sakkinen@linux.intel.com/ exposure of the chip->tpm_mutex was removed from much of the upper level code. In this conversion, tpm2_del_space() was missed. This didn't matter much because it's usually called closely after a converted operation, so there's only a very tiny race window where the chip can be removed before the space flushing is done which causes a NULL deref on the mutex. However, there are reports of this window being hit in practice, so fix this by converting tpm2_del_space() to use tpm_try_get_ops(), which performs all the teardown checks before acquring the mutex.

CVSS3: 5.5
redhat
больше 1 года назад

In the Linux kernel, the following vulnerability has been resolved: tpm: use try_get_ops() in tpm-space.c As part of the series conversion to remove nested TPM operations: https://lore.kernel.org/all/20190205224723.19671-1-jarkko.sakkinen@linux.intel.com/ exposure of the chip->tpm_mutex was removed from much of the upper level code. In this conversion, tpm2_del_space() was missed. This didn't matter much because it's usually called closely after a converted operation, so there's only a very tiny race window where the chip can be removed before the space flushing is done which causes a NULL deref on the mutex. However, there are reports of this window being hit in practice, so fix this by converting tpm2_del_space() to use tpm_try_get_ops(), which performs all the teardown checks before acquring the mutex.

CVSS3: 4.7
nvd
больше 1 года назад

In the Linux kernel, the following vulnerability has been resolved: tpm: use try_get_ops() in tpm-space.c As part of the series conversion to remove nested TPM operations: https://lore.kernel.org/all/20190205224723.19671-1-jarkko.sakkinen@linux.intel.com/ exposure of the chip->tpm_mutex was removed from much of the upper level code. In this conversion, tpm2_del_space() was missed. This didn't matter much because it's usually called closely after a converted operation, so there's only a very tiny race window where the chip can be removed before the space flushing is done which causes a NULL deref on the mutex. However, there are reports of this window being hit in practice, so fix this by converting tpm2_del_space() to use tpm_try_get_ops(), which performs all the teardown checks before acquring the mutex.

CVSS3: 4.7
debian
больше 1 года назад

In the Linux kernel, the following vulnerability has been resolved: t ...

CVSS3: 4.7
github
11 месяцев назад

In the Linux kernel, the following vulnerability has been resolved: tpm: use try_get_ops() in tpm-space.c As part of the series conversion to remove nested TPM operations: https://lore.kernel.org/all/20190205224723.19671-1-jarkko.sakkinen@linux.intel.com/ exposure of the chip->tpm_mutex was removed from much of the upper level code. In this conversion, tpm2_del_space() was missed. This didn't matter much because it's usually called closely after a converted operation, so there's only a very tiny race window where the chip can be removed before the space flushing is done which causes a NULL deref on the mutex. However, there are reports of this window being hit in practice, so fix this by converting tpm2_del_space() to use tpm_try_get_ops(), which performs all the teardown checks before acquring the mutex.

EPSS

Процентиль: 14%
0.00234
Низкий

4.7 Medium

CVSS3

3.8 Low

CVSS2