CVE-2022-48898

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

drm/msm/dp: do not complete dp_aux_cmd_fifo_tx() if irq is not for aux transfer

There are 3 possible interrupt sources are handled by DP controller,

HPDstatus, Controller state changes and Aux read/write transaction.

At every irq, DP controller have to check isr status of every interrupt

sources and service the interrupt if its isr status bits shows interrupts

are pending. There is potential race condition may happen at current aux

isr handler implementation since it is always complete dp_aux_cmd_fifo_tx()

even irq is not for aux read or write transaction. This may cause aux read

transaction return premature if host aux data read is in the middle of

waiting for sink to complete transferring data to host while irq happen.

This will cause host's receiving buffer contains unexpected data. This

patch fixes this problem by checking aux isr and return immediately at

aux isr handler if there are no any isr status bits set.

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References