CVE-2022-49286: tpm: use try_get_ops() in tpm-space.c
In the Linux kernel, the following vulnerability has been resolved:
tpm: use trygetops() in tpm-space.c
As part of the series conversion to remove nested TPM operations:
https://lore.kernel.org/all/20190205224723.19671-1-jarkko.sakkinen@linux.intel.com/
exposure of the chip->tpmmutex was removed from much of the upper level code. In this conversion, tpm2delspace() was missed. This didn't matter much because it's usually called closely after a converted operation, so there's only a very tiny race window where the chip can be removed before the space flushing is done which causes a NULL deref on the mutex. However, there are reports of this window being hit in practice, so fix this by converting tpm2delspace() to use tpmtrygetops(), which performs all the teardown checks before acquring the mutex.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch tpm: use try_get_ops() in tpm-space.c - Configuration
Update the Linux kernel TPM space handling code so it uses tpm_try_get_ops() (performing all teardown checks before acquiring mutex), and ensure tpm2_del_space() is converted so chip removal cannot occur after space flushing begins (closing the NULL deref race window).
tpm-space.c / TPM driver Use tpm_try_get_ops() in place of direct ops access (per fix: tpm: use try_get_ops() in tpm-space.c) = enabled
Event History
Frequently Asked Questions
Under what conditions can this issue be triggered?
The race occurs when tpm2_del_space() is flushing TPM space while the TPM chip is being removed. The affected window is described as very small, but it has been observed in practice.
What level of access does an attacker need?
The supplied CVSS vector indicates local access, low privileges, no user interaction, and high attack complexity. No network access is indicated.
What is the likely impact if the race is hit?
Removal of the chip during space flushing can cause a NULL dereference on the TPM mutex. The CVSS vector indicates an availability impact, with no confidentiality or integrity impact.
What does the fix change?
The fix converts tpm2_del_space() to use tpm_try_get_ops(). This performs TPM teardown checks before acquiring the mutex, preventing use of the mutex after chip removal.