CVE-2022-48898

一、漏洞信息
 漏洞编号：[CVE-2022-48898](https://nvd.nist.gov/vuln/detail/CVE-2022-48898)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
 CVSS V2.0分值：
  BaseScore：0.0 Low
  Vector：CVSS：2.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:drm/msm/dp: do not complete dp_aux_cmd_fifo_tx() if irq is not for aux transferThere are 3 possible interrupt sources are handled by DP controller,HPDstatus, Controller state changes and Aux read/write transaction.At every irq, DP controller have to check isr status of every interruptsources and service the interrupt if its isr status bits shows interruptsare pending. There is potential race condition may happen at current auxisr handler implementation since it is always complete dp_aux_cmd_fifo_tx()even irq is not for aux read or write transaction. This may cause aux readtransaction return premature if host aux data read is in the middle ofwaiting for sink to complete transferring data to host while irq happen.This will cause host s receiving buffer contains unexpected data. Thispatch fixes this problem by checking aux isr and return immediately ataux isr handler if there are no any isr status bits set.Current there is a bug report regrading eDP edid corruption happen duringsystem booting up. After lengthy debugging to found that VIDEO_READYinterrupt was continuously firing during system booting up which causedp_aux_isr() to complete dp_aux_cmd_fifo_tx() prematurely to retrieve datafrom aux hardware buffer which is not yet contains complete data transferfrom sink. This cause edid corruption.Follows are the signature at kernel logs when problem happen,EDID has corrupt headerpanel-simple-dp-aux aux-aea0000.edp: Couldn t identify panel via EDIDChanges in v2:-- do complete if (ret == IRQ_HANDLED) ay dp-aux_isr()-- add more commit textChanges in v3:-- add Stephen suggested-- dp_aux_isr() return IRQ_XXX back to caller-- dp_ctrl_isr() return IRQ_XXX back to callerChanges in v4:-- split into two patchesChanges in v5:-- delete empty line between tagsChanges in v6:-- remove extra  that  and fixed line more than 75 char at commit textPatchwork: https://patchwork.freedesktop.org/patch/516121/
 漏洞公开时间：2024-08-21 15:15:05
 漏洞创建时间：2024-08-22 03:39:02
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2022-48898
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/1cba0d150fa102439114a91b3e215909efc9f169 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/785607e5e6fb52caf141e4580de40405565f04f1 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/984ad875db804948c86ca9e1c2e784ae8252715a |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/b7dcbca46db3c77fdb02c2a9d6239e5aa3b06a59 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-48898 | https://bugzilla.suse.com/show_bug.cgi?id=1229537 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2022-48898 | https://bugzilla.suse.com/show_bug.cgi?id=1229537 |
| suse_bugzilla | https://git.kernel.org/stable/c/1cba0d150fa102439114a91b3e215909efc9f169 | https://bugzilla.suse.com/show_bug.cgi?id=1229537 |
| suse_bugzilla | https://git.kernel.org/stable/c/785607e5e6fb52caf141e4580de40405565f04f1 | https://bugzilla.suse.com/show_bug.cgi?id=1229537 |
| suse_bugzilla | https://git.kernel.org/stable/c/984ad875db804948c86ca9e1c2e784ae8252715a | https://bugzilla.suse.com/show_bug.cgi?id=1229537 |
| suse_bugzilla | https://git.kernel.org/stable/c/b7dcbca46db3c77fdb02c2a9d6239e5aa3b06a59 | https://bugzilla.suse.com/show_bug.cgi?id=1229537 |
| ubuntu | https://www.cve.org/CVERecord?id=CVE-2022-48898 | https://ubuntu.com/security/CVE-2022-48898 |
| ubuntu | https://git.kernel.org/linus/1cba0d150fa102439114a91b3e215909efc9f169 (6.2-rc4) | https://ubuntu.com/security/CVE-2022-48898 |
| ubuntu | https://git.kernel.org/stable/c/785607e5e6fb52caf141e4580de40405565f04f1 | https://ubuntu.com/security/CVE-2022-48898 |
| ubuntu | https://git.kernel.org/stable/c/984ad875db804948c86ca9e1c2e784ae8252715a | https://ubuntu.com/security/CVE-2022-48898 |
| ubuntu | https://git.kernel.org/stable/c/b7dcbca46db3c77fdb02c2a9d6239e5aa3b06a59 | https://ubuntu.com/security/CVE-2022-48898 |
| ubuntu | https://git.kernel.org/stable/c/1cba0d150fa102439114a91b3e215909efc9f169 | https://ubuntu.com/security/CVE-2022-48898 |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2022-48898 | https://ubuntu.com/security/CVE-2022-48898 |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2022-48898 | https://ubuntu.com/security/CVE-2022-48898 |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2022-48898 | https://ubuntu.com/security/CVE-2022-48898 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| linux |  | https://git.kernel.org/linus/1cba0d150fa102439114a91b3e215909efc9f169 | https://git.kernel.org/linus/c943b4948b5848fc0e07f875edbd35a973879e22 | ubuntu |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
    In the Linux kernel, the following vulnerability has been resolved:drm/msm/dp: do not complete dp_aux_cmd_fifo_tx() if irq is not for aux transferThere are 3 possible interrupt sources are handled by DP controller,HPDstatus, Controller state changes and Aux read/write transaction.At every irq, DP controller have to check isr status of every interruptsources and service the interrupt if its isr status bits shows interruptsare pending. There is potential race condition may happen at current auxisr handler implementation since it is always complete dp_aux_cmd_fifo_tx()even irq is not for aux read or write transaction. This may cause aux readtransaction return premature if host aux data read is in the middle ofwaiting for sink to complete transferring data to host while irq happen.This will cause host&#39;s receiving buffer contains unexpected data. Thispatch fixes this problem by checking aux isr and return immediately ataux isr handler if there are no any isr status bits set.Current there is a bug report regrading eDP edid corruption happen duringsystem booting up. After lengthy debugging to found that VIDEO_READYinterrupt was continuously firing during system booting up which causedp_aux_isr() to complete dp_aux_cmd_fifo_tx() prematurely to retrieve datafrom aux hardware buffer which is not yet contains complete data transferfrom sink. This cause edid corruption.Follows are the signature at kernel logs when problem happen,EDID has corrupt headerpanel-simple-dp-aux aux-aea0000.edp: Couldn&#39;t identify panel via EDIDChanges in v2:-- do complete if (ret == IRQ_HANDLED) ay dp-aux_isr()-- add more commit textChanges in v3:-- add Stephen suggested-- dp_aux_isr() return IRQ_XXX back to caller-- dp_ctrl_isr() return IRQ_XXX back to callerChanges in v4:-- split into two patchesChanges in v5:-- delete empty line between tagsChanges in v6:-- remove extra &#34;that&#34; and fixed line more than 75 char at commit textPatchwork: <ahref= https://patchwork.freedesktop.org/patch/516121/ >https://patchwork.freedesktop.org/patch/516121/</a>The Linux kernel CVE team has assigned CVE-2022-48898 to this issue. 
 openEuler评分：
  3.9
 Vector：CVSS：2.0/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
 受影响版本排查(受影响/不受影响)：
  1.openEuler-22.03-LTS-SP1(5.10.0):受影响
2.openEuler-20.03-LTS-SP4(4.19.90):不受影响
3.openEuler-22.03-LTS-SP3(5.10.0):不受影响
4.openEuler-22.03-LTS-SP4(5.10.0):不受影响
5.master(6.1.0):不受影响
6.openEuler-24.03-LTS(6.6.0):不受影响
7.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1(5.10.0):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.master(6.1.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-22.03-LTS-SP4(5.10.0):否

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2024-2080

src-openEuler/kernel

内容风险标识

评论 (10)

src-openEuler/kernel .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2022-48898

评论 (10)

搜索帮助

src-openEuler/kernel