CVE-2022-48723 in Linux
Summary
by MITRE • 06/20/2024
In the Linux kernel, the following vulnerability has been resolved:
spi: uniphier: fix reference count leak in uniphier_spi_probe()
The issue happens in several error paths in uniphier_spi_probe(). When either dma_get_slave_caps() or devm_spi_register_master() returns an error code, the function forgets to decrease the refcount of both `dma_rx` and `dma_tx` objects, which may lead to refcount leaks.
Fix it by decrementing the reference count of specific objects in those error paths.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 06/20/2024
The vulnerability described in CVE-2022-48723 represents a critical reference count leak within the Linux kernel's SPI subsystem, specifically affecting the UniPhier SPI driver implementation. This flaw resides in the uniphier_spi_probe() function where proper resource cleanup is not executed during error conditions, creating a potential memory management issue that could lead to system instability over time. The vulnerability impacts systems utilizing UniPhier-based SPI controllers where the driver initialization process encounters failures during DMA capability retrieval or SPI master registration phases. The reference count leak occurs when either dma_get_slave_caps() or devm_spi_register_master() functions return error codes, indicating that the driver cannot properly acquire the necessary DMA resources or register the SPI master controller. This specific issue demonstrates a classic resource management failure pattern where allocated resources are not properly released when error conditions are encountered during driver initialization, leading to gradual memory consumption and potential system resource exhaustion. The problem is categorized under CWE-404, which addresses improper resource release or failure to release resources, making it a direct violation of proper memory management practices in kernel space operations. The vulnerability affects the fundamental operation of the SPI bus controller driver and can potentially impact data transfer reliability and system stability when the driver fails to properly initialize under error conditions. According to ATT&CK framework, this vulnerability could be leveraged as part of a resource exhaustion attack vector where sustained error conditions could lead to system performance degradation or denial of service scenarios. The reference count leak specifically targets DMA transaction objects, which are critical for high-speed data transfers in embedded systems, making this particularly concerning for automotive, industrial, and embedded computing applications where UniPhier SoCs are commonly deployed. The fix implemented addresses the root cause by ensuring that the reference counts for both dma_rx and dma_tx objects are properly decremented in all error paths, thereby maintaining proper resource accounting and preventing the accumulation of unreleased references. This remediation aligns with kernel development best practices for error handling and resource management, ensuring that all allocated resources are properly accounted for regardless of whether the driver initialization succeeds or fails. The vulnerability demonstrates the importance of comprehensive error path testing in kernel development, particularly for drivers that manage complex hardware resources such as DMA controllers and SPI bus interfaces. The fix maintains the existing driver functionality while ensuring proper cleanup of allocated resources, preventing potential memory leaks that could accumulate over time and impact system performance. This type of vulnerability is particularly significant in embedded systems where memory resources are limited and efficient resource management is critical for system reliability and long-term operation. The resolution addresses the specific conditions where the driver initialization process encounters failures, ensuring that the kernel's reference counting mechanism properly tracks the DMA resources and prevents the accumulation of unreleased references that could eventually lead to system instability or resource exhaustion. The vulnerability highlights the need for rigorous testing of error paths in kernel drivers, as these conditions often represent the most challenging scenarios for proper resource management and can have cascading effects on system stability and performance.