PT-2025-8215 · Linux+3 · Linux Kernel+3
Published
2022-03-08
·
Updated
2025-09-29
·
CVE-2022-49287
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to the version containing the fix for the reference counting issue in the tpm module
Description
A reference counting issue in the Linux kernel's tpm module can lead to a use-after-free warning. This occurs when a specific sequence of operations is performed, including opening the /dev/tpmrm device, removing the tpm tis spi module, and writing a TPM command to the file descriptor. The issue arises from the attempt to get the chip->dev reference in tpm common write() when the reference counter is already zero. This is due to the extra reference used to prevent a premature zero counter never being taken because the required TPM CHIP FLAG TPM2 flag is never set.
Recommendations
To resolve this issue, update the Linux kernel to a version that includes the fix for the reference counting issue in the tpm module. Specifically, the fix involves moving the TPM 2 character device handling from tpm chip alloc() to tpm add char device(), releasing the extra reference in tpm devs release(), and putting chip->devs in tpm chip unregister(). As a temporary workaround, consider avoiding the sequence of operations that triggers the warning, such as not removing the tpm tis spi module while the /dev/tpmrm device is open.
Exploit
Fix
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Linux Kernel
Red Hat
Suse