CVE-2022-49309: drivers: staging: rtl8723bs: Fix deadlock in rtw_surveydone_event_callback()
In the Linux kernel, the following vulnerability has been resolved:
drivers: staging: rtl8723bs: Fix deadlock in rtwsurveydoneeventcallback()
There is a deadlock in rtwsurveydoneeventcallback(), which is shown below:
(Thread 1) | (Thread 2) | settimer() rtwsurveydoneeventcallback()| modtimer() spinlockbh() //(1) | (wait a time) ... | rtwscantimeouthandler() deltimersync() | spinlockbh() //(2) (wait timer to stop) | ...
We hold pmlmepriv->lock in position (1) of thread 1 and use deltimersync() to wait timer to stop, but timer handler also need pmlmepriv->lock in position (2) of thread 2. As a result, rtwsurveydoneeventcallback() will block forever.
This patch extracts deltimersync() from the protection of spinlockbh(), which could let timer handler to obtain the needed lock. Whats more, we change spinlockbh() in rtwscantimeouthandler() to spinlockirq(). Otherwise, spinlockbh() will also cause deadlock() in timer handler.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drivers: staging: rtl8723bsto a version that resolves this vulnerability.Patch Fix deadlock in rtw_surveydone_event_callback() - Configuration
Apply the kernel patch for rtl8723bs that extracts del_timer_sync() from the protection of pmlmepriv->lock to resolve the deadlock.
rtw_surveydone_event_callback() timer handling del_timer_sync() protection / locking = Move del_timer_sync() outside the protection of pmlmepriv->lock; extract del_timer_sync() so it is not executed while holding pmlmepriv->lock - Configuration
Apply the kernel patch for rtl8723bs that changes spin_lock_bh() to spin_lock_irq() in rtw_scan_timeout_handler() to prevent the timer handler from deadlocking when obtaining the needed lock.
rtw_scan_timeout_handler() locking spin_lock_bh()/spin_lock_irq() usage = Change spin_lock_bh() to spin_lock_irq()
Event History
Frequently Asked Questions
What is the severity of CVE-2022-49309?
CVE-2022-49309 has a medium severity level due to the potential for deadlock in the Linux kernel.
How do I fix CVE-2022-49309?
To fix CVE-2022-49309, you should upgrade your Linux kernel to version 5.17.15 or above, or any version beyond 5.18.4.
What causes CVE-2022-49309?
CVE-2022-49309 is caused by a deadlock occurring in the rtw_surveydone_event_callback function within the Linux kernel.
Which Linux kernel versions are affected by CVE-2022-49309?
Linux kernel versions from 5.15 to 5.18.4 are affected by CVE-2022-49309.
Is there a mitigation strategy for CVE-2022-49309?
The only mitigation strategy for CVE-2022-49309 is to apply the proper upgrades that resolve the deadlock issue.