CVE-2022-49313
Linux Kernel USB Host Deadlock
Description
In the Linux kernel, the following vulnerability has been resolved: drivers: usb: host: Fix deadlock in oxu_bus_suspend() There is a deadlock in oxu_bus_suspend(), which is shown below: (Thread 1) | (Thread 2) | timer_action() oxu_bus_suspend() | mod_timer() spin_lock_irq() //(1) | (wait a time) ... | oxu_watchdog() del_timer_sync() | spin_lock_irq() //(2) (wait timer to stop) | ... We hold oxu->lock in position (1) of thread 1, and use del_timer_sync() to wait timer to stop, but timer handler also need oxu->lock in position (2) of thread 2. As a result, oxu_bus_suspend() will block forever. This patch extracts del_timer_sync() from the protection of spin_lock_irq(), which could let timer handler to obtain the needed lock.
INFO
Published Date :
Feb. 26, 2025, 7:01 a.m.
Last Modified :
April 14, 2025, 7:59 p.m.
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Remotely Exploitable :
No
Impact Score :
3.6
Exploitability Score :
1.8
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2022-49313.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2022-49313 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2022-49313 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Apr. 14, 2025
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Added CWE CWE-667 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.20 up to (excluding) 5.4.198 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.10 up to (excluding) 4.14.283 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.15 up to (excluding) 4.19.247 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.18 up to (excluding) 5.18.4 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 5.17.15 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.47 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions up to (excluding) 4.9.318 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.5 up to (excluding) 5.10.122 Added Reference Type kernel.org: https://git.kernel.org/stable/c/2dcec0bc142be2096af71a5703d63237127db204 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/4187b291a76664a3c03d3f0d9bfadc8322881868 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/4d378f2ae58138d4c55684e1d274e7dd94aa6524 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/9b58d255f27b0ed6a2e43208960864d67579db58 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/a3d380188bde8900c3f604e82b56572896499124 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/b97aae8b43b718314012e8170b7e03dbfd2e7677 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/d888753872190abd18f68a7d77b9c7c367f0a7ab Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/f8242044c91cafbba9e320b0fb31abf2429a3221 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/ffe9440d698274c6462d2e304562c6ddfc8c84df Types: Patch -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Feb. 26, 2025
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: drivers: usb: host: Fix deadlock in oxu_bus_suspend() There is a deadlock in oxu_bus_suspend(), which is shown below: (Thread 1) | (Thread 2) | timer_action() oxu_bus_suspend() | mod_timer() spin_lock_irq() //(1) | (wait a time) ... | oxu_watchdog() del_timer_sync() | spin_lock_irq() //(2) (wait timer to stop) | ... We hold oxu->lock in position (1) of thread 1, and use del_timer_sync() to wait timer to stop, but timer handler also need oxu->lock in position (2) of thread 2. As a result, oxu_bus_suspend() will block forever. This patch extracts del_timer_sync() from the protection of spin_lock_irq(), which could let timer handler to obtain the needed lock. Added Reference https://git.kernel.org/stable/c/2dcec0bc142be2096af71a5703d63237127db204 Added Reference https://git.kernel.org/stable/c/4187b291a76664a3c03d3f0d9bfadc8322881868 Added Reference https://git.kernel.org/stable/c/4d378f2ae58138d4c55684e1d274e7dd94aa6524 Added Reference https://git.kernel.org/stable/c/9b58d255f27b0ed6a2e43208960864d67579db58 Added Reference https://git.kernel.org/stable/c/a3d380188bde8900c3f604e82b56572896499124 Added Reference https://git.kernel.org/stable/c/b97aae8b43b718314012e8170b7e03dbfd2e7677 Added Reference https://git.kernel.org/stable/c/d888753872190abd18f68a7d77b9c7c367f0a7ab Added Reference https://git.kernel.org/stable/c/f8242044c91cafbba9e320b0fb31abf2429a3221 Added Reference https://git.kernel.org/stable/c/ffe9440d698274c6462d2e304562c6ddfc8c84df
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2022-49313 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2022-49313
weaknesses.