CVE-2022-49286: tpm: use try_get_ops() in tpm-space.c
In the Linux kernel, the following vulnerability has been resolved:
tpm: use trygetops() in tpm-space.c
As part of the series conversion to remove nested TPM operations:
https://lore.kernel.org/all/20190205224723.19671-1-jarkko.sakkinen@linux.intel.com/
exposure of the chip->tpmmutex was removed from much of the upper level code. In this conversion, tpm2delspace() was missed. This didn't matter much because it's usually called closely after a converted operation, so there's only a very tiny race window where the chip can be removed before the space flushing is done which causes a NULL deref on the mutex. However, there are reports of this window being hit in practice, so fix this by converting tpm2delspace() to use tpmtrygetops(), which performs all the teardown checks before acquring the mutex.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch tpm: use try_get_ops() in tpm-space.c - Configuration
Update the Linux kernel TPM space handling code so it uses tpm_try_get_ops() (performing all teardown checks before acquiring mutex), and ensure tpm2_del_space() is converted so chip removal cannot occur after space flushing begins (closing the NULL deref race window).
tpm-space.c / TPM driver Use tpm_try_get_ops() in place of direct ops access (per fix: tpm: use try_get_ops() in tpm-space.c) = enabled