CVE-2022-49458
Linux Kernel vulnerability analysis and mitigation

Overview

CVE-2022-49458 affects the Linux kernel's DRM (Direct Rendering Manager) MSM driver. The vulnerability was discovered in the error handling path of msmdrmuninit() when it's called from msmdrminit(). The issue occurs when attempting to free an IRQ that was not previously requested, which happens when an error occurs before the request_irq() call (Kernel Git).

Technical details

The vulnerability stems from improper IRQ handling in the MSM DRM driver. When msmdrmuninit() is called during an error in initialization, it attempts to free an IRQ resource using free_irq() without first verifying if the IRQ was actually requested. This leads to a 'Trying to free already-free IRQ' warning and potential system instability. The issue was introduced by commit f026e431cf86 'drm/msm: Convert to Linux IRQ interfaces' (Kernel Git).

Impact

The vulnerability can trigger kernel warnings and potentially lead to system instability when the MSM DRM driver initialization fails. This primarily affects systems using Qualcomm's MSM graphics hardware (Kernel Git).

Mitigation and workarounds

The issue was fixed by adding a boolean flag irqrequested to track whether the IRQ was successfully requested, and only calling freeirq() if this flag is set. The fix was implemented in the Linux kernel through a patch that adds proper IRQ resource tracking (Kernel Git).

Additional resources


SourceThis report was generated using AI

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Get a personalized demo

Ready to see Wiz in action?

“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management