GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-49287 (GCVE-0-2022-49287)

Vulnerability from cvelistv5 – Published: 2025-02-26 01:56 – Updated: 2026-08-05 08:54
VLAI
Title
tpm: fix reference counting for struct tpm_chip
Summary
In the Linux kernel, the following vulnerability has been resolved: tpm: fix reference counting for struct tpm_chip The following sequence of operations results in a refcount warning: 1. Open device /dev/tpmrm. 2. Remove module tpm_tis_spi. 3. Write a TPM command to the file descriptor opened at step 1. ------------[ cut here ]------------ WARNING: CPU: 3 PID: 1161 at lib/refcount.c:25 kobject_get+0xa0/0xa4 refcount_t: addition on 0; use-after-free. Modules linked in: tpm_tis_spi tpm_tis_core tpm mdio_bcm_unimac brcmfmac sha256_generic libsha256 sha256_arm hci_uart btbcm bluetooth cfg80211 vc4 brcmutil ecdh_generic ecc snd_soc_core crc32_arm_ce libaes raspberrypi_hwmon ac97_bus snd_pcm_dmaengine bcm2711_thermal snd_pcm snd_timer genet snd phy_generic soundcore [last unloaded: spi_bcm2835] CPU: 3 PID: 1161 Comm: hold_open Not tainted 5.10.0ls-main-dirty #2 Hardware name: BCM2711 [<c0410c3c>] (unwind_backtrace) from [<c040b580>] (show_stack+0x10/0x14) [<c040b580>] (show_stack) from [<c1092174>] (dump_stack+0xc4/0xd8) [<c1092174>] (dump_stack) from [<c0445a30>] (__warn+0x104/0x108) [<c0445a30>] (__warn) from [<c0445aa8>] (warn_slowpath_fmt+0x74/0xb8) [<c0445aa8>] (warn_slowpath_fmt) from [<c08435d0>] (kobject_get+0xa0/0xa4) [<c08435d0>] (kobject_get) from [<bf0a715c>] (tpm_try_get_ops+0x14/0x54 [tpm]) [<bf0a715c>] (tpm_try_get_ops [tpm]) from [<bf0a7d6c>] (tpm_common_write+0x38/0x60 [tpm]) [<bf0a7d6c>] (tpm_common_write [tpm]) from [<c05a7ac0>] (vfs_write+0xc4/0x3c0) [<c05a7ac0>] (vfs_write) from [<c05a7ee4>] (ksys_write+0x58/0xcc) [<c05a7ee4>] (ksys_write) from [<c04001a0>] (ret_fast_syscall+0x0/0x4c) Exception stack(0xc226bfa8 to 0xc226bff0) bfa0: 00000000 000105b4 00000003 beafe664 00000014 00000000 bfc0: 00000000 000105b4 000103f8 00000004 00000000 00000000 b6f9c000 beafe684 bfe0: 0000006c beafe648 0001056c b6eb6944 ---[ end trace d4b8409def9b8b1f ]--- The reason for this warning is the attempt to get the chip->dev reference in tpm_common_write() although the reference counter is already zero. Since commit 8979b02aaf1d ("tpm: Fix reference count to main device") the extra reference used to prevent a premature zero counter is never taken, because the required TPM_CHIP_FLAG_TPM2 flag is never set. Fix this by moving the TPM 2 character device handling from tpm_chip_alloc() to tpm_add_char_device() which is called at a later point in time when the flag has been set in case of TPM2. Commit fdc915f7f719 ("tpm: expose spaces via a device link /dev/tpmrm<n>") already introduced function tpm_devs_release() to release the extra reference but did not implement the required put on chip->devs that results in the call of this function. Fix this by putting chip->devs in tpm_chip_unregister(). Finally move the new implementation for the TPM 2 handling into a new function to avoid multiple checks for the TPM_CHIP_FLAG_TPM2 flag in the good case and error cases.
Severity
7 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-02-27 18:16 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66 , < 473a66f99cb8173c14138c5a5c69bfad04e8f9ac (git)
Affected: fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66 , < cb64bd038beacb4331fe464a36c8b5481e8f51e2 (git)
Affected: fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66 , < a27ed2f3695baf15f9b34d2d7a1f9fc105539a81 (git)
Affected: fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66 , < 290e05f346d1829e849662c97e42d5ad984f5258 (git)
Affected: fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66 , < 662893b4f6bd466ff9e1cd454c44c26d32d554fe (git)
Affected: fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66 , < 2f928c0d5c02dbab49e8c19d98725c822f6fc409 (git)
Affected: fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66 , < 6e7baf84149fb43950631415de231b3a41915aa3 (git)
Affected: fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66 , < 7e0438f83dc769465ee663bb5dcf8cc154940712 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.12
Unaffected: 0 , < 4.12 (semver)
Unaffected: 4.14.276 , ≤ 4.14.* (semver)
Unaffected: 4.19.238 , ≤ 4.19.* (semver)
Unaffected: 5.4.189 , ≤ 5.4.* (semver)
Unaffected: 5.10.110 , ≤ 5.10.* (semver)
Unaffected: 5.15.33 , ≤ 5.15.* (semver)
Unaffected: 5.16.19 , ≤ 5.16.* (semver)
Unaffected: 5.17.1 , ≤ 5.17.* (semver)
Unaffected: 5.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-49287",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-27T18:16:50.967565Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-27T18:22:34.163Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/char/tpm/tpm-chip.c",
            "drivers/char/tpm/tpm.h",
            "drivers/char/tpm/tpm2-space.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "473a66f99cb8173c14138c5a5c69bfad04e8f9ac",
              "status": "affected",
              "version": "fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66",
              "versionType": "git"
            },
            {
              "lessThan": "cb64bd038beacb4331fe464a36c8b5481e8f51e2",
              "status": "affected",
              "version": "fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66",
              "versionType": "git"
            },
            {
              "lessThan": "a27ed2f3695baf15f9b34d2d7a1f9fc105539a81",
              "status": "affected",
              "version": "fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66",
              "versionType": "git"
            },
            {
              "lessThan": "290e05f346d1829e849662c97e42d5ad984f5258",
              "status": "affected",
              "version": "fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66",
              "versionType": "git"
            },
            {
              "lessThan": "662893b4f6bd466ff9e1cd454c44c26d32d554fe",
              "status": "affected",
              "version": "fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66",
              "versionType": "git"
            },
            {
              "lessThan": "2f928c0d5c02dbab49e8c19d98725c822f6fc409",
              "status": "affected",
              "version": "fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66",
              "versionType": "git"
            },
            {
              "lessThan": "6e7baf84149fb43950631415de231b3a41915aa3",
              "status": "affected",
              "version": "fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66",
              "versionType": "git"
            },
            {
              "lessThan": "7e0438f83dc769465ee663bb5dcf8cc154940712",
              "status": "affected",
              "version": "fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/char/tpm/tpm-chip.c",
            "drivers/char/tpm/tpm.h",
            "drivers/char/tpm/tpm2-space.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.12"
            },
            {
              "lessThan": "4.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.276",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.238",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.276",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.238",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.189",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.110",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.33",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16.19",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.1",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntpm: fix reference counting for struct tpm_chip\n\nThe following sequence of operations results in a refcount warning:\n\n1. Open device /dev/tpmrm.\n2. Remove module tpm_tis_spi.\n3. Write a TPM command to the file descriptor opened at step 1.\n\n------------[ cut here ]------------\nWARNING: CPU: 3 PID: 1161 at lib/refcount.c:25 kobject_get+0xa0/0xa4\nrefcount_t: addition on 0; use-after-free.\nModules linked in: tpm_tis_spi tpm_tis_core tpm mdio_bcm_unimac brcmfmac\nsha256_generic libsha256 sha256_arm hci_uart btbcm bluetooth cfg80211 vc4\nbrcmutil ecdh_generic ecc snd_soc_core crc32_arm_ce libaes\nraspberrypi_hwmon ac97_bus snd_pcm_dmaengine bcm2711_thermal snd_pcm\nsnd_timer genet snd phy_generic soundcore [last unloaded: spi_bcm2835]\nCPU: 3 PID: 1161 Comm: hold_open Not tainted 5.10.0ls-main-dirty #2\nHardware name: BCM2711\n[\u003cc0410c3c\u003e] (unwind_backtrace) from [\u003cc040b580\u003e] (show_stack+0x10/0x14)\n[\u003cc040b580\u003e] (show_stack) from [\u003cc1092174\u003e] (dump_stack+0xc4/0xd8)\n[\u003cc1092174\u003e] (dump_stack) from [\u003cc0445a30\u003e] (__warn+0x104/0x108)\n[\u003cc0445a30\u003e] (__warn) from [\u003cc0445aa8\u003e] (warn_slowpath_fmt+0x74/0xb8)\n[\u003cc0445aa8\u003e] (warn_slowpath_fmt) from [\u003cc08435d0\u003e] (kobject_get+0xa0/0xa4)\n[\u003cc08435d0\u003e] (kobject_get) from [\u003cbf0a715c\u003e] (tpm_try_get_ops+0x14/0x54 [tpm])\n[\u003cbf0a715c\u003e] (tpm_try_get_ops [tpm]) from [\u003cbf0a7d6c\u003e] (tpm_common_write+0x38/0x60 [tpm])\n[\u003cbf0a7d6c\u003e] (tpm_common_write [tpm]) from [\u003cc05a7ac0\u003e] (vfs_write+0xc4/0x3c0)\n[\u003cc05a7ac0\u003e] (vfs_write) from [\u003cc05a7ee4\u003e] (ksys_write+0x58/0xcc)\n[\u003cc05a7ee4\u003e] (ksys_write) from [\u003cc04001a0\u003e] (ret_fast_syscall+0x0/0x4c)\nException stack(0xc226bfa8 to 0xc226bff0)\nbfa0:                   00000000 000105b4 00000003 beafe664 00000014 00000000\nbfc0: 00000000 000105b4 000103f8 00000004 00000000 00000000 b6f9c000 beafe684\nbfe0: 0000006c beafe648 0001056c b6eb6944\n---[ end trace d4b8409def9b8b1f ]---\n\nThe reason for this warning is the attempt to get the chip-\u003edev reference\nin tpm_common_write() although the reference counter is already zero.\n\nSince commit 8979b02aaf1d (\"tpm: Fix reference count to main device\") the\nextra reference used to prevent a premature zero counter is never taken,\nbecause the required TPM_CHIP_FLAG_TPM2 flag is never set.\n\nFix this by moving the TPM 2 character device handling from\ntpm_chip_alloc() to tpm_add_char_device() which is called at a later point\nin time when the flag has been set in case of TPM2.\n\nCommit fdc915f7f719 (\"tpm: expose spaces via a device link /dev/tpmrm\u003cn\u003e\")\nalready introduced function tpm_devs_release() to release the extra\nreference but did not implement the required put on chip-\u003edevs that results\nin the call of this function.\n\nFix this by putting chip-\u003edevs in tpm_chip_unregister().\n\nFinally move the new implementation for the TPM 2 handling into a new\nfunction to avoid multiple checks for the TPM_CHIP_FLAG_TPM2 flag in the\ngood case and error cases."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is a local character-device write on /dev/tpmrmN (tpmrm_open \u2192 tpm_common_write \u2192 tpm_try_get_ops \u2192 get_device), not reachable via network protocols or remote packet processing.\nAC:H - Triggering the UAF requires tpm_chip_unregister (e.g. rmmod/unbind of tpm_tis_spi) while the attacker still holds the FD; that teardown needs CAP_SYS_MODULE/admin and is outside the control of a tss-group opener, so success depends on a concurrent system state the attacker cannot initiate.\nPR:L - Opening/writing /dev/tpmrmN only requires access typically granted as 0660 tss:tss (udev), not real root/CAP_SYS_ADMIN; that is low privilege relative to init-namespace admin capabilities.\nUI:N - The attacker opens and writes their own FD; no separate victim action is required once the chip has been unregistered beneath that FD.\nS:U - Impact is use-after-free and potential privilege escalation inside the same host kernel authority; this is not a VM escape, IOMMU bypass, or other cross-boundary break.\nC:H - The bug is an explicit use-after-free of struct tpm_chip (refcount addition on 0), which enables reclaim/spray of the freed object and arbitrary kernel read primitives.\nI:H - The same tpm_chip UAF yields a corruptible kernel object for arbitrary write and control-flow hijacking via standard heap exploitation techniques.\nA:H - The UAF already produces a kernel warning/oops path on get_device after free and can crash the kernel even without a full exploit."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:54:36.034Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/473a66f99cb8173c14138c5a5c69bfad04e8f9ac"
        },
        {
          "url": "https://git.kernel.org/stable/c/cb64bd038beacb4331fe464a36c8b5481e8f51e2"
        },
        {
          "url": "https://git.kernel.org/stable/c/a27ed2f3695baf15f9b34d2d7a1f9fc105539a81"
        },
        {
          "url": "https://git.kernel.org/stable/c/290e05f346d1829e849662c97e42d5ad984f5258"
        },
        {
          "url": "https://git.kernel.org/stable/c/662893b4f6bd466ff9e1cd454c44c26d32d554fe"
        },
        {
          "url": "https://git.kernel.org/stable/c/2f928c0d5c02dbab49e8c19d98725c822f6fc409"
        },
        {
          "url": "https://git.kernel.org/stable/c/6e7baf84149fb43950631415de231b3a41915aa3"
        },
        {
          "url": "https://git.kernel.org/stable/c/7e0438f83dc769465ee663bb5dcf8cc154940712"
        }
      ],
      "title": "tpm: fix reference counting for struct tpm_chip",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49287",
    "datePublished": "2025-02-26T01:56:26.059Z",
    "dateReserved": "2025-02-26T01:49:39.302Z",
    "dateUpdated": "2026-08-05T08:54:36.034Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49287",
      "date": "2026-09-17",
      "epss": "0.00275",
      "percentile": "0.20046"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49287\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-26T07:01:05.557\",\"lastModified\":\"2026-08-04T10:17:42.947\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntpm: fix reference counting for struct tpm_chip\\n\\nThe following sequence of operations results in a refcount warning:\\n\\n1. Open device /dev/tpmrm.\\n2. Remove module tpm_tis_spi.\\n3. Write a TPM command to the file descriptor opened at step 1.\\n\\n------------[ cut here ]------------\\nWARNING: CPU: 3 PID: 1161 at lib/refcount.c:25 kobject_get+0xa0/0xa4\\nrefcount_t: addition on 0; use-after-free.\\nModules linked in: tpm_tis_spi tpm_tis_core tpm mdio_bcm_unimac brcmfmac\\nsha256_generic libsha256 sha256_arm hci_uart btbcm bluetooth cfg80211 vc4\\nbrcmutil ecdh_generic ecc snd_soc_core crc32_arm_ce libaes\\nraspberrypi_hwmon ac97_bus snd_pcm_dmaengine bcm2711_thermal snd_pcm\\nsnd_timer genet snd phy_generic soundcore [last unloaded: spi_bcm2835]\\nCPU: 3 PID: 1161 Comm: hold_open Not tainted 5.10.0ls-main-dirty #2\\nHardware name: BCM2711\\n[\u003cc0410c3c\u003e] (unwind_backtrace) from [\u003cc040b580\u003e] (show_stack+0x10/0x14)\\n[\u003cc040b580\u003e] (show_stack) from [\u003cc1092174\u003e] (dump_stack+0xc4/0xd8)\\n[\u003cc1092174\u003e] (dump_stack) from [\u003cc0445a30\u003e] (__warn+0x104/0x108)\\n[\u003cc0445a30\u003e] (__warn) from [\u003cc0445aa8\u003e] (warn_slowpath_fmt+0x74/0xb8)\\n[\u003cc0445aa8\u003e] (warn_slowpath_fmt) from [\u003cc08435d0\u003e] (kobject_get+0xa0/0xa4)\\n[\u003cc08435d0\u003e] (kobject_get) from [\u003cbf0a715c\u003e] (tpm_try_get_ops+0x14/0x54 [tpm])\\n[\u003cbf0a715c\u003e] (tpm_try_get_ops [tpm]) from [\u003cbf0a7d6c\u003e] (tpm_common_write+0x38/0x60 [tpm])\\n[\u003cbf0a7d6c\u003e] (tpm_common_write [tpm]) from [\u003cc05a7ac0\u003e] (vfs_write+0xc4/0x3c0)\\n[\u003cc05a7ac0\u003e] (vfs_write) from [\u003cc05a7ee4\u003e] (ksys_write+0x58/0xcc)\\n[\u003cc05a7ee4\u003e] (ksys_write) from [\u003cc04001a0\u003e] (ret_fast_syscall+0x0/0x4c)\\nException stack(0xc226bfa8 to 0xc226bff0)\\nbfa0:                   00000000 000105b4 00000003 beafe664 00000014 00000000\\nbfc0: 00000000 000105b4 000103f8 00000004 00000000 00000000 b6f9c000 beafe684\\nbfe0: 0000006c beafe648 0001056c b6eb6944\\n---[ end trace d4b8409def9b8b1f ]---\\n\\nThe reason for this warning is the attempt to get the chip-\u003edev reference\\nin tpm_common_write() although the reference counter is already zero.\\n\\nSince commit 8979b02aaf1d (\\\"tpm: Fix reference count to main device\\\") the\\nextra reference used to prevent a premature zero counter is never taken,\\nbecause the required TPM_CHIP_FLAG_TPM2 flag is never set.\\n\\nFix this by moving the TPM 2 character device handling from\\ntpm_chip_alloc() to tpm_add_char_device() which is called at a later point\\nin time when the flag has been set in case of TPM2.\\n\\nCommit fdc915f7f719 (\\\"tpm: expose spaces via a device link /dev/tpmrm\u003cn\u003e\\\")\\nalready introduced function tpm_devs_release() to release the extra\\nreference but did not implement the required put on chip-\u003edevs that results\\nin the call of this function.\\n\\nFix this by putting chip-\u003edevs in tpm_chip_unregister().\\n\\nFinally move the new implementation for the TPM 2 handling into a new\\nfunction to avoid multiple checks for the TPM_CHIP_FLAG_TPM2 flag in the\\ngood case and error cases.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: tpm: arreglo del recuento de referencias para struct tpm_chip La siguiente secuencia de operaciones genera una advertencia de recuento de referencias: 1. Abra el dispositivo /dev/tpmrm. 2. Elimine el m\u00f3dulo tpm_tis_spi. 3. Escriba un comando TPM en el descriptor de archivo abierto en el paso 1. ------------[ cortar aqu\u00ed ]------------ ADVERTENCIA: CPU: 3 PID: 1161 en lib/refcount.c:25 kobject_get+0xa0/0xa4 refcount_t: adici\u00f3n en 0; use-after-free. M\u00f3dulos vinculados en: tpm_tis_spi tpm_tis_core tpm mdio_bcm_unimac brcmfmac sha256_generic libsha256 sha256_arm hci_uart btbcm bluetooth cfg80211 vc4 brcmutil ecdh_generic ecc snd_soc_core crc32_arm_ce libaes raspberrypi_hwmon ac97_bus snd_pcm_dmaengine bcm2711_thermal snd_pcm snd_timer genet snd phy_generic soundcore [\u00faltima descarga: spi_bcm2835] CPU: 3 PID: 1161 Comm: hold_open No contaminado 5.10.0ls-main-dirty #2 Nombre del hardware: BCM2711 [] (unwind_backtrace) from [] (show_stack+0x10/0x14) [] (show_stack) desde [] (dump_stack+0xc4/0xd8) [] (dump_stack) from [] (__warn+0x104/0x108) [] (__warn) from [] (warn_slowpath_fmt+0x74/0xb8) [] (warn_slowpath_fmt) from [] (kobject_get+0xa0/0xa4) [] (kobject_get) desde [] (tpm_try_get_ops+0x14/0x54 [tpm]) [] (tpm_try_get_ops [tpm]) desde[] (tpm_common_write+0x38/0x60 [tpm]) [] (tpm_common_write [tpm]) desde[] (vfs_write+0xc4/0x3c0) [] (vfs_write) desde[] (ksys_write+0x58/0xcc) [] (ksys_write) desde[] (ret_fast_syscall+0x0/0x4c) Pila de excepciones (0xc226bfa8 a 0xc226bff0) bfa0: 00000000 000105b4 00000003 beafe664 00000014 00000000 bfc0: 00000000 000105b4 000103f8 00000004 00000000 00000000 b6f9c000 beafe684 bfe0: 0000006c beafe648 0001056c b6eb6944 ---[ fin del seguimiento d4b8409def9b8b1f ]--- El motivo de esta advertencia es el intento de obtener el chip-\u0026gt;dev referencia en tpm_common_write() aunque el contador de referencia ya es cero. Desde el commit 8979b02aaf1d (\\\"tpm: Fix reference count to main device\\\") la referencia adicional utilizada para evitar un contador cero prematuro nunca se toma, porque el indicador TPM_CHIP_FLAG_TPM2 requerido nunca se establece. Corrija esto moviendo la gesti\u00f3n del dispositivo de caracteres TPM 2 de tpm_chip_alloc() a tpm_add_char_device() que se llama en un punto posterior en el tiempo cuando el indicador se ha establecido en el caso de TPM2. el commit fdc915f7f719 (\\\"tpm: exponer espacios a trav\u00e9s de un enlace de dispositivo /dev/tpmrm\\\") ya introdujo la funci\u00f3n tpm_devs_release() para liberar la referencia adicional pero no implement\u00f3 la funci\u00f3n put en chip-\u0026gt;devs requerida que da como resultado la llamada de esta funci\u00f3n. Corrija esto colocando chip-\u0026gt;devs en tpm_chip_unregister(). Finalmente, mueva la nueva implementaci\u00f3n para la gesti\u00f3n de TPM 2 a una nueva funci\u00f3n para evitar m\u00faltiples verificaciones del indicador TPM_CHIP_FLAG_TPM2 en los casos buenos y de error.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/char/tpm/tpm-chip.c\",\"drivers/char/tpm/tpm.h\",\"drivers/char/tpm/tpm2-space.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66\",\"lessThan\":\"473a66f99cb8173c14138c5a5c69bfad04e8f9ac\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66\",\"lessThan\":\"cb64bd038beacb4331fe464a36c8b5481e8f51e2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66\",\"lessThan\":\"a27ed2f3695baf15f9b34d2d7a1f9fc105539a81\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66\",\"lessThan\":\"290e05f346d1829e849662c97e42d5ad984f5258\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66\",\"lessThan\":\"662893b4f6bd466ff9e1cd454c44c26d32d554fe\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66\",\"lessThan\":\"2f928c0d5c02dbab49e8c19d98725c822f6fc409\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66\",\"lessThan\":\"6e7baf84149fb43950631415de231b3a41915aa3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66\",\"lessThan\":\"7e0438f83dc769465ee663bb5dcf8cc154940712\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/char/tpm/tpm-chip.c\",\"drivers/char/tpm/tpm.h\",\"drivers/char/tpm/tpm2-space.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.14.276\",\"lessThanOrEqual\":\"4.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.238\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.189\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.110\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.33\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.16.19\",\"lessThanOrEqual\":\"5.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.17.1\",\"lessThanOrEqual\":\"5.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.18\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.0,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-02-27T18:16:50.967565Z\",\"id\":\"CVE-2022-49287\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.12\",\"versionEndExcluding\":\"4.14.276\",\"matchCriteriaId\":\"76EDAF8B-A61C-4220-A866-7A0A933212D4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.15\",\"versionEndExcluding\":\"4.19.238\",\"matchCriteriaId\":\"FA28527A-11D3-41D2-9C4C-ECAC0D6A4A2D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.189\",\"matchCriteriaId\":\"8CB6E8F5-C2B1-46F3-A807-0F6104AC340F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.110\",\"matchCriteriaId\":\"91D3BFD0-D3F3-4018-957C-96CCBF357D79\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.33\",\"matchCriteriaId\":\"27C42AE8-B387-43E2-938A-E1C8B40BE6D5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.16.19\",\"matchCriteriaId\":\"20C43679-0439-405A-B97F-685BEE50613B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.17\",\"versionEndExcluding\":\"5.17.1\",\"matchCriteriaId\":\"3004D9BF-0093-4C9C-8560-F3E91AFAE409\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/290e05f346d1829e849662c97e42d5ad984f5258\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2f928c0d5c02dbab49e8c19d98725c822f6fc409\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/473a66f99cb8173c14138c5a5c69bfad04e8f9ac\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/662893b4f6bd466ff9e1cd454c44c26d32d554fe\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6e7baf84149fb43950631415de231b3a41915aa3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7e0438f83dc769465ee663bb5dcf8cc154940712\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a27ed2f3695baf15f9b34d2d7a1f9fc105539a81\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cb64bd038beacb4331fe464a36c8b5481e8f51e2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:59:39+00:00",
      "cve": "CVE-2022-49287",
      "id": "CVE-2022-49287",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_affected": "198",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: tpm: fix reference counting for struct tpm_chip",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49287.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-03T16:59:24Z",
      "cve": "CVE-2022-49287",
      "id": "CVE-2022-49287",
      "initial_release_date": "2025-02-27T03:09:24Z",
      "product_status:known_not_affected": "315",
      "product_status:recommended": "300",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-49287",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-49287.json",
      "version": "45"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-49287\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-27T18:16:50.967565Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-27T18:16:52.692Z\"}}], \"cna\": {\"title\": \"tpm: fix reference counting for struct tpm_chip\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable path is a local character-device write on /dev/tpmrmN (tpmrm_open \\u2192 tpm_common_write \\u2192 tpm_try_get_ops \\u2192 get_device), not reachable via network protocols or remote packet processing.\\nAC:H - Triggering the UAF requires tpm_chip_unregister (e.g. rmmod/unbind of tpm_tis_spi) while the attacker still holds the FD; that teardown needs CAP_SYS_MODULE/admin and is outside the control of a tss-group opener, so success depends on a concurrent system state the attacker cannot initiate.\\nPR:L - Opening/writing /dev/tpmrmN only requires access typically granted as 0660 tss:tss (udev), not real root/CAP_SYS_ADMIN; that is low privilege relative to init-namespace admin capabilities.\\nUI:N - The attacker opens and writes their own FD; no separate victim action is required once the chip has been unregistered beneath that FD.\\nS:U - Impact is use-after-free and potential privilege escalation inside the same host kernel authority; this is not a VM escape, IOMMU bypass, or other cross-boundary break.\\nC:H - The bug is an explicit use-after-free of struct tpm_chip (refcount addition on 0), which enables reclaim/spray of the freed object and arbitrary kernel read primitives.\\nI:H - The same tpm_chip UAF yields a corruptible kernel object for arbitrary write and control-flow hijacking via standard heap exploitation techniques.\\nA:H - The UAF already produces a kernel warning/oops path on get_device after free and can crash the kernel even without a full exploit.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66\", \"lessThan\": \"473a66f99cb8173c14138c5a5c69bfad04e8f9ac\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66\", \"lessThan\": \"cb64bd038beacb4331fe464a36c8b5481e8f51e2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66\", \"lessThan\": \"a27ed2f3695baf15f9b34d2d7a1f9fc105539a81\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66\", \"lessThan\": \"290e05f346d1829e849662c97e42d5ad984f5258\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66\", \"lessThan\": \"662893b4f6bd466ff9e1cd454c44c26d32d554fe\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66\", \"lessThan\": \"2f928c0d5c02dbab49e8c19d98725c822f6fc409\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66\", \"lessThan\": \"6e7baf84149fb43950631415de231b3a41915aa3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66\", \"lessThan\": \"7e0438f83dc769465ee663bb5dcf8cc154940712\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/char/tpm/tpm-chip.c\", \"drivers/char/tpm/tpm.h\", \"drivers/char/tpm/tpm2-space.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.12\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.12\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.14.276\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.14.*\"}, {\"status\": \"unaffected\", \"version\": \"4.19.238\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.189\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.110\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.33\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"5.16.19\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.16.*\"}, {\"status\": \"unaffected\", \"version\": \"5.17.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.17.*\"}, {\"status\": \"unaffected\", \"version\": \"5.18\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/char/tpm/tpm-chip.c\", \"drivers/char/tpm/tpm.h\", \"drivers/char/tpm/tpm2-space.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/473a66f99cb8173c14138c5a5c69bfad04e8f9ac\"}, {\"url\": \"https://git.kernel.org/stable/c/cb64bd038beacb4331fe464a36c8b5481e8f51e2\"}, {\"url\": \"https://git.kernel.org/stable/c/a27ed2f3695baf15f9b34d2d7a1f9fc105539a81\"}, {\"url\": \"https://git.kernel.org/stable/c/290e05f346d1829e849662c97e42d5ad984f5258\"}, {\"url\": \"https://git.kernel.org/stable/c/662893b4f6bd466ff9e1cd454c44c26d32d554fe\"}, {\"url\": \"https://git.kernel.org/stable/c/2f928c0d5c02dbab49e8c19d98725c822f6fc409\"}, {\"url\": \"https://git.kernel.org/stable/c/6e7baf84149fb43950631415de231b3a41915aa3\"}, {\"url\": \"https://git.kernel.org/stable/c/7e0438f83dc769465ee663bb5dcf8cc154940712\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntpm: fix reference counting for struct tpm_chip\\n\\nThe following sequence of operations results in a refcount warning:\\n\\n1. Open device /dev/tpmrm.\\n2. Remove module tpm_tis_spi.\\n3. Write a TPM command to the file descriptor opened at step 1.\\n\\n------------[ cut here ]------------\\nWARNING: CPU: 3 PID: 1161 at lib/refcount.c:25 kobject_get+0xa0/0xa4\\nrefcount_t: addition on 0; use-after-free.\\nModules linked in: tpm_tis_spi tpm_tis_core tpm mdio_bcm_unimac brcmfmac\\nsha256_generic libsha256 sha256_arm hci_uart btbcm bluetooth cfg80211 vc4\\nbrcmutil ecdh_generic ecc snd_soc_core crc32_arm_ce libaes\\nraspberrypi_hwmon ac97_bus snd_pcm_dmaengine bcm2711_thermal snd_pcm\\nsnd_timer genet snd phy_generic soundcore [last unloaded: spi_bcm2835]\\nCPU: 3 PID: 1161 Comm: hold_open Not tainted 5.10.0ls-main-dirty #2\\nHardware name: BCM2711\\n[\u003cc0410c3c\u003e] (unwind_backtrace) from [\u003cc040b580\u003e] (show_stack+0x10/0x14)\\n[\u003cc040b580\u003e] (show_stack) from [\u003cc1092174\u003e] (dump_stack+0xc4/0xd8)\\n[\u003cc1092174\u003e] (dump_stack) from [\u003cc0445a30\u003e] (__warn+0x104/0x108)\\n[\u003cc0445a30\u003e] (__warn) from [\u003cc0445aa8\u003e] (warn_slowpath_fmt+0x74/0xb8)\\n[\u003cc0445aa8\u003e] (warn_slowpath_fmt) from [\u003cc08435d0\u003e] (kobject_get+0xa0/0xa4)\\n[\u003cc08435d0\u003e] (kobject_get) from [\u003cbf0a715c\u003e] (tpm_try_get_ops+0x14/0x54 [tpm])\\n[\u003cbf0a715c\u003e] (tpm_try_get_ops [tpm]) from [\u003cbf0a7d6c\u003e] (tpm_common_write+0x38/0x60 [tpm])\\n[\u003cbf0a7d6c\u003e] (tpm_common_write [tpm]) from [\u003cc05a7ac0\u003e] (vfs_write+0xc4/0x3c0)\\n[\u003cc05a7ac0\u003e] (vfs_write) from [\u003cc05a7ee4\u003e] (ksys_write+0x58/0xcc)\\n[\u003cc05a7ee4\u003e] (ksys_write) from [\u003cc04001a0\u003e] (ret_fast_syscall+0x0/0x4c)\\nException stack(0xc226bfa8 to 0xc226bff0)\\nbfa0:                   00000000 000105b4 00000003 beafe664 00000014 00000000\\nbfc0: 00000000 000105b4 000103f8 00000004 00000000 00000000 b6f9c000 beafe684\\nbfe0: 0000006c beafe648 0001056c b6eb6944\\n---[ end trace d4b8409def9b8b1f ]---\\n\\nThe reason for this warning is the attempt to get the chip-\u003edev reference\\nin tpm_common_write() although the reference counter is already zero.\\n\\nSince commit 8979b02aaf1d (\\\"tpm: Fix reference count to main device\\\") the\\nextra reference used to prevent a premature zero counter is never taken,\\nbecause the required TPM_CHIP_FLAG_TPM2 flag is never set.\\n\\nFix this by moving the TPM 2 character device handling from\\ntpm_chip_alloc() to tpm_add_char_device() which is called at a later point\\nin time when the flag has been set in case of TPM2.\\n\\nCommit fdc915f7f719 (\\\"tpm: expose spaces via a device link /dev/tpmrm\u003cn\u003e\\\")\\nalready introduced function tpm_devs_release() to release the extra\\nreference but did not implement the required put on chip-\u003edevs that results\\nin the call of this function.\\n\\nFix this by putting chip-\u003edevs in tpm_chip_unregister().\\n\\nFinally move the new implementation for the TPM 2 handling into a new\\nfunction to avoid multiple checks for the TPM_CHIP_FLAG_TPM2 flag in the\\ngood case and error cases.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.14.276\", \"versionStartIncluding\": \"4.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.238\", \"versionStartIncluding\": \"4.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.189\", \"versionStartIncluding\": \"4.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.110\", \"versionStartIncluding\": \"4.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.33\", \"versionStartIncluding\": \"4.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.16.19\", \"versionStartIncluding\": \"4.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.17.1\", \"versionStartIncluding\": \"4.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.18\", \"versionStartIncluding\": \"4.12\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:54:36.034Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-49287\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:54:36.034Z\", \"dateReserved\": \"2025-02-26T01:49:39.302Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-02-26T01:56:26.059Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.