CVE-2022-49489
Published: 26 February 2025
Description
In the Linux kernel, the following vulnerability has been resolved: drm/msm/disp/dpu1: set vbif hw config to NULL to avoid use after memory free during pm runtime resume BUG: Unable to handle kernel paging request at virtual address 006b6b6b6b6b6be3 Call trace: dpu_vbif_init_memtypes+0x40/0xb8 dpu_runtime_resume+0xcc/0x1c0 pm_generic_runtime_resume+0x30/0x44 __genpd_runtime_resume+0x68/0x7c genpd_runtime_resume+0x134/0x258 __rpm_callback+0x98/0x138 rpm_callback+0x30/0x88 rpm_resume+0x36c/0x49c __pm_runtime_resume+0x80/0xb0 dpu_core_irq_uninstall+0x30/0xb0 dpu_irq_uninstall+0x18/0x24 msm_drm_uninit+0xd8/0x16c Patchwork: https://patchwork.freedesktop.org/patch/483255/ [DB: fixed Fixes tag]
Security Summary
CVE-2022-49489 is a use-after-free vulnerability (CWE-416) in the Linux kernel's drm/msm/disp/dpu1 subsystem. The issue arises during power management runtime resume operations, where the VBIF hardware configuration is not set to NULL after memory is freed, leading to an invalid kernel paging request at a corrupted virtual address. This triggers a crash traceable through functions like dpu_vbif_init_memtypes, dpu_runtime_resume, and msm_drm_uninit. The vulnerability affects Linux kernels incorporating the MSM DRM driver, commonly used in Qualcomm-based systems.
A local attacker with low privileges (PR:L) can exploit this vulnerability with low complexity (AC:L) and no user interaction (UI:N), requiring only local access (AV:L) in an unchanged security scope (S:U). Successful exploitation yields high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), with a CVSS v3.1 base score of 7.8. This could enable kernel memory corruption, potentially leading to privilege escalation, arbitrary code execution, or system denial of service via the runtime resume path.
Mitigation involves applying upstream kernel patches, such as those referenced in the stable kernel commits (e.g., 134760263f6441741db0b2970e7face6b34b6d1c, 5b0adf5cbf3b74721e4e4c4e0cadc91b8df8bcc2) and the Freedesktop Patchwork submission (https://patchwork.freedesktop.org/patch/483255/). These fixes explicitly set the VBIF hardware configuration to NULL to prevent use-after-free during resume. Security practitioners should update affected Linux kernels to incorporate these changes.
Details
- CWE(s)