CVE-2022-49130

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ath11k: mhi: use mhi_sync_power_up()

If amss.bin was missing ath11k would crash during 'rmmod ath11k_pci'. The

reason for that was that we were using mhi_async_power_up() which does not

check any errors. But mhi_sync_power_up() on the other hand does check for

errors so let's use that to fix the crash.

I was not able to find a reason why an async version was used.

ath11k_mhi_start() (which enables state ATH11K_MHI_POWER_ON) is called from

ath11k_hif_power_up(), which can sleep. So sync version should be safe to use

here.

[ 145.569731] general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC KASAN PTI

[ 145.569789] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]

[ 145.569843] CPU: 2 PID: 1628 Comm: rmmod Kdump: loaded Tainted: G W 5.16.0-wt-ath+ #567

[ 145.569898] Hardware name: Intel(R) Client Systems NUC8i7HVK/N

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References