CVE-2022-48997

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

char: tpm: Protect tpm_pm_suspend with locks

Currently tpm transactions are executed unconditionally in

tpm_pm_suspend() function, which may lead to races with other tpm

accessors in the system.

Specifically, the hw_random tpm driver makes use of tpm_get_random(),

and this function is called in a loop from a kthread, which means it's

not frozen alongside userspace, and so can race with the work done

during system suspend:

tpm tpm0: tpm_transmit: tpm_recv: error -52

tpm tpm0: invalid TPM_STS.x 0xff, dumping stack for forensics

CPU: 0 PID: 1 Comm: init Not tainted 6.1.0-rc5+ #135

Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-20220807_005459-localhost 04/01/2014

Call Trace:

tpm_tis_status.cold+0x19/0x20

tpm_transmit+0x13b/0x390

tpm_transmit_cmd+0x20/0x80

tpm1_pm_suspend+0xa6/0x110

tpm_pm_suspend+0x53/0x80

__pnp_bus_suspend+0x35/0xe0

__device_suspend+0x10f/0x350

Fix thi

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References