« Volver al listado

CVE-2022-49506

Estado: AnalizadaMedia (5.5)—

In the Linux kernel, the following vulnerability has been resolved:

drm/mediatek: Add vblank register/unregister callback functions

We encountered a kernel panic issue that callback data will be NULL when it's using in ovl irq handler. There is a timing issue between mtk_disp_ovl_irq_handler() and mtk_ovl_disable_vblank().

To resolve this issue, we use the flow to register/unregister vblank cb: - Register callback function and callback data when crtc creates. - Unregister callback function and callback data when crtc destroies.

With this solution, we can assure callback data will not be NULL when vblank is disable.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Linux — Linux Kernel

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-49506",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "9b0704988b151824a51133dc4c921f4273c5d839",
              "lessThan": "8a2dbdeccef6de47565638abdf3c25f41cdffc37",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9b0704988b151824a51133dc4c921f4273c5d839",
              "lessThan": "8a265d9838bc3c63579002d55c2b2c655c4f8f26",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9b0704988b151824a51133dc4c921f4273c5d839",
              "lessThan": "3a4027b5971fe2a94e32754f007d9d3c12c68ad1",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9b0704988b151824a51133dc4c921f4273c5d839",
              "lessThan": "b74d921b900b6ce38c6247c0a1c86be9f3746493",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/gpu/drm/mediatek/mtk_disp_drv.h",
            "drivers/gpu/drm/mediatek/mtk_disp_ovl.c",
            "drivers/gpu/drm/mediatek/mtk_disp_rdma.c",
            "drivers/gpu/drm/mediatek/mtk_drm_crtc.c",
            "drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c",
            "drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.h"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.12",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.15.54",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "5.17.14",
              "versionType": "semver",
              "lessThanOrEqual": "5.17.*"
            },
            {
              "status": "unaffected",
              "version": "5.18.3",
              "versionType": "semver",
              "lessThanOrEqual": "5.18.*"
            },
            {
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/gpu/drm/mediatek/mtk_disp_drv.h",
            "drivers/gpu/drm/mediatek/mtk_disp_ovl.c",
            "drivers/gpu/drm/mediatek/mtk_disp_rdma.c",
            "drivers/gpu/drm/mediatek/mtk_drm_crtc.c",
            "drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c",
            "drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.h"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-02-26T07:01:26.737",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/3a4027b5971fe2a94e32754f007d9d3c12c68ad1",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/8a265d9838bc3c63579002d55c2b2c655c4f8f26",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/8a2dbdeccef6de47565638abdf3c25f41cdffc37",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b74d921b900b6ce38c6247c0a1c86be9f3746493",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/mediatek: Add vblank register/unregister callback functions\n\nWe encountered a kernel panic issue that callback data will be NULL when\nit's using in ovl irq handler. There is a timing issue between\nmtk_disp_ovl_irq_handler() and mtk_ovl_disable_vblank().\n\nTo resolve this issue, we use the flow to register/unregister vblank cb:\n- Register callback function and callback data when crtc creates.\n- Unregister callback function and callback data when crtc destroies.\n\nWith this solution, we can assure callback data will not be NULL when\nvblank is disable."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/mediatek: Agregar funciones de devolución de llamada de registro/cancelación de vblank Encontramos un problema de pánico del kernel que indicaba que los datos de devolución de llamada serían NULL cuando se usaban en el controlador de irq de ovl. Hay un problema de sincronización entre mtk_disp_ovl_irq_handler() y mtk_ovl_disable_vblank(). Para resolver este problema, usamos el flujo para registrar/cancelar el cb de vblank: - Registrar la función de devolución de llamada y los datos de devolución de llamada cuando se crea crtc. - Cancelar la función de devolución de llamada y los datos de devolución de llamada cuando se destruye crtc. Con esta solución, podemos asegurar que los datos de devolución de llamada no serían NULL cuando se deshabilita vblank."
    }
  ],
  "lastModified": "2026-06-17T05:18:16.370",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FA8346B0-71FD-40BD-9BBC-1173FD7AF6C0",
              "versionEndExcluding": "5.15.54",
              "versionStartIncluding": "5.12"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "15E2DD33-2255-4B76-9C15-04FF8CBAB252",
              "versionEndExcluding": "5.17.14",
              "versionStartIncluding": "5.16"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8E122216-2E9E-4B3E-B7B8-D575A45BA3C2",
              "versionEndExcluding": "5.18.3",
              "versionStartIncluding": "5.18"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}