CVE-2022-50700

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath10k: Delay the unmapping of the buffer

On WCN3990, we are seeing a rare scenario where copy engine hardware is

sending a copy complete interrupt to the host driver while still

processing the buffer that the driver has sent, this is leading into an

SMMU fault triggering kernel panic. This is happening on copy engine

channel 3 (CE3) where the driver normally enqueues WMI commands to the

firmware. Upon receiving a copy complete interrupt, host driver will

immediately unmap and frees the buffer presuming that hardware has

processed the buffer. In the issue case, upon receiving copy complete

interrupt, host driver will unmap and free the buffer but since hardware

is still accessing the buffer (which in this case got unmapped in

parallel), SMMU hardware will trigger an SMMU fault resulting in a

kernel panic.

In order to avoid this, as a work around, add a delay before unmapping

the copy engine source DMA buffer.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References