CyberSecBulletin
CVE-2022-49509NVD status: Analyzed

Linux: Exposure of Resource to Wrong Sphere

Published Updated By the CyberSecBulletin desk

CVE-2022-49509 is a high-severity exposure of resource to wrong sphere vulnerability in Linux, with a CVSS 3.1 base score of 7.1 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions a4ec75df70575cdf33d9638c7844e729bfe6ce24, 579c77595dbbdfe4f2edf335899f86ac51eca4e9, 9dd783274c89c21a038d967b52a858a297e767f8 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.29% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to a4ec75df70575cdf33d9638c7844e729bfe6ce24 or 579c77595dbbdfe4f2edf335899f86ac51eca4e9 or 9dd783274c89c21a038d967b52a858a297e767f8 or 365ab7ebc24eebb42b9e020aeb440d51af8960cd, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.15.46 or 5.17.14 or 5.18.3, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux66d8c9d2422da21ed41f75c03ba0685987b65fe0 up to, but not including, a4ec75df70575cdf33d9638c7844e729bfe6ce24; 66d8c9d2422da21ed41f75c03ba0685987b65fe0 up to, but not including, 579c77595dbbdfe4f2edf335899f86ac51eca4e9; 66d8c9d2422da21ed41f75c03ba0685987b65fe0 up to, but not including, 9dd783274c89c21a038d967b52a858a297e767f8; 66d8c9d2422da21ed41f75c03ba0685987b65fe0 up to, but not including, 365ab7ebc24eebb42b9e020aeb440d51af8960cd; 5.9a4ec75df70575cdf33d9638c7844e729bfe6ce24, 579c77595dbbdfe4f2edf335899f86ac51eca4e9, 9dd783274c89c21a038d967b52a858a297e767f8, 365ab7ebc24eebb42b9e020aeb440d51af8960cd
LinuxLinux Kernel5.9 up to, but not including, 5.15.46; 5.16 up to, but not including, 5.17.14; 5.18 up to, but not including, 5.18.35.15.46, 5.17.14, 5.18.3

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. Scored by NVD.

Official description

In the Linux kernel, the following vulnerability has been resolved: media: i2c: max9286: fix kernel oops when removing module When removing the max9286 module we get a kernel oops: Unable to handle kernel paging request at virtual address 000000aa00000094 Mem abort info: ESR = 0x96000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004 CM = 0, WnR = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=0000000880d85000 [000000aa00000094] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 96000004 [#1] PREEMPT SMP Modules linked in: fsl_jr_uio caam_jr rng_core libdes caamkeyblob_desc caamhash_desc caamalg_desc crypto_engine max9271 authenc crct10dif_ce mxc_jpeg_encdec CPU: 2 PID: 713 Comm: rmmod Tainted: G C 5.15.5-00057-gaebcd29c8ed7-dirty #5 Hardware name: Freescale i.MX8QXP MEK (DT) pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : i2c_mux_del_adapters+0x24/0xf0 lr : max9286_remove+0x28/0xd0 [max9286] sp : ffff800013a9bbf0 x29: ffff800013a9bbf0 x28: ffff00080b6da940 x27: 0000000000000000 x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000 x23: ffff000801a5b970 x22: ffff0008048b0890 x21: ffff800009297000 x20: ffff0008048b0f70 x19: 000000aa00000064 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 x14: 0000000000000014 x13: 0000000000000000 x12: ffff000802da49e8 x11: ffff000802051918 x10: ffff000802da4920 x9 : ffff000800030098 x8 : 0101010101010101 x7 : 7f7f7f7f7f7f7f7f x6 : fefefeff6364626d x5 : 8080808000000000 x4 : 0000000000000000 x3 : 0000000000000000 x2 : ffffffffffffffff x1 : ffff00080b6da940 x0 : 0000000000000000 Call trace: i2c_mux_del_adapters+0x24/0xf0 max9286_remove+0x28/0xd0 [max9286] i2c_device_remove+0x40/0x110 __device_release_driver+0x188/0x234 driver_detach+0xc4/0x150 bus_remove_driver+0x60/0xe0 driver_unregister+0x34/0x64 i2c_del_driver+0x58/0xa0 max9286_i2c_driver_exit+0x1c/0x490 [max9286] __arm64_sys_delete_module+0x194/0x260 invoke_syscall+0x48/0x114 el0_svc_common.constprop.0+0xd4/0xfc do_el0_svc+0x2c/0x94 el0_svc+0x28/0x80 el0t_64_sync_handler+0xa8/0x130 el0t_64_sync+0x1a0/0x1a4 The Oops happens because the I2C client data does not point to max9286_priv anymore but to v4l2_subdev. The change happened in max9286_init() which calls v4l2_i2c_subdev_init() later on... Besides fixing the max9286_remove() function, remove the call to i2c_set_clientdata() in max9286_probe(), to avoid confusion, and make the necessary changes to max9286_init() so that it doesn't have to use i2c_get_clientdata() in order to fetch the pointer to priv.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Exposure of Resource to Wrong Sphere

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

More Exposure of Resource to Wrong Sphere vulnerabilities (CWE-668)

Timeline

  1. CVE record published.
  2. Record last changed materially (score, affected products, status or references).

References

Recent Exposure of Resource to Wrong Sphere vulnerabilities

Spotted an error? Tell us.