CVE-2022-49943

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

USB: gadget: Fix obscure lockdep violation for udc_mutex

A recent commit expanding the scope of the udc_lock mutex in the

gadget core managed to cause an obscure and slightly bizarre lockdep

violation. In abbreviated form:

======================================================

WARNING: possible circular locking dependency detected

5.19.0-rc7+ #12510 Not tainted

------------------------------------------------------

udevadm/312 is trying to acquire lock:

ffff80000aae1058 (udc_lock){+.+.}-{3:3}, at: usb_udc_uevent+0x54/0xe0

but task is already holding lock:

ffff000002277548 (kn->active#4){++++}-{0:0}, at: kernfs_seq_start+0x34/0xe0

which lock already depends on the new lock.

the existing dependency chain (in reverse order) is:

-> #3 (kn->active#4){++++}-{0:0}:

       lock_acquire+0x68/0x84

       __kernfs_remove+0x268/0x380

       kernfs_remove_by_name_ns+0x58/0xac

       sysfs_remove_file_ns+0x18/0x24

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References