43:I[352089,["/_next/static/chunks/0gr5brj8-gdtv.js"],"IconMark"] 1d:["$","meta","4",{"name":"robots","content":"index, follow"}] 1e:["$","meta","5",{"name":"googlebot","content":"index, follow"}] 1f:["$","meta","6",{"name":"mobile-web-app-capable","content":"yes"}] 20:["$","meta","7",{"name":"google-tag-gateway-opt-out","content":"true"}] 21:["$","link","8",{"rel":"canonical","href":"https://hol.org/guard/security/cves/CVE-2022-49287-tpm-fix-reference-counting-for-struct-tpmchip"}] 22:["$","meta","9",{"name":"format-detection","content":"telephone=no"}] 23:["$","meta","10",{"name":"mobile-web-app-capable","content":"yes"}] 24:["$","meta","11",{"name":"apple-mobile-web-app-title","content":"HOL"}] 25:["$","meta","12",{"name":"apple-mobile-web-app-status-bar-style","content":"default"}] 26:["$","meta","13",{"property":"og:title","content":"tpm: fix reference counting for struct tpm_chip (CVE-2022-49287) | HOL Guard CVE"}] 41:Tb6e,In the Linux kernel, the following vulnerability has been resolved: tpm: fix reference counting for struct tpm_chip The following sequence of operations results in a refcount warning: 1. Open device /dev/tpmrm. 2. Remove module tpm_tis_spi. 3. Write a TPM command to the file descriptor opened at step 1. ------------[ cut here ]------------ WARNING: CPU: 3 PID: 1161 at lib/refcount.c:25 kobject_get+0xa0/0xa4 refcount_t: addition on 0; use-after-free. Modules linked in: tpm_tis_spi tpm_tis_core tpm mdio_bcm_unimac brcmfmac sha256_generic libsha256 sha256_arm hci_uart btbcm bluetooth cfg80211 vc4 brcmutil ecdh_generic ecc snd_soc_core crc32_arm_ce libaes raspberrypi_hwmon ac97_bus snd_pcm_dmaengine bcm2711_thermal snd_pcm snd_timer genet snd phy_generic soundcore [last unloaded: spi_bcm2835] CPU: 3 PID: 1161 Comm: hold_open Not tainted 5.10.0ls-main-dirty #2 Hardware name: BCM2711 [] (unwind_backtrace) from [] (show_stack+0x10/0x14) [] (show_stack) from [] (dump_stack+0xc4/0xd8) [] (dump_stack) from [] (__warn+0x104/0x108) [] (__warn) from [] (warn_slowpath_fmt+0x74/0xb8) [] (warn_slowpath_fmt) from [] (kobject_get+0xa0/0xa4) [] (kobject_get) from [] (tpm_try_get_ops+0x14/0x54 [tpm]) [] (tpm_try_get_ops [tpm]) from [] (tpm_common_write+0x38/0x60 [tpm]) [] (tpm_common_write [tpm]) from [] (vfs_write+0xc4/0x3c0) [] (vfs_write) from [] (ksys_write+0x58/0xcc) [] (ksys_write) from [] (ret_fast_syscall+0x0/0x4c) Exception stack(0xc226bfa8 to 0xc226bff0) bfa0: 00000000 000105b4 00000003 beafe664 00000014 00000000 bfc0: 00000000 000105b4 000103f8 00000004 00000000 00000000 b6f9c000 beafe684 bfe0: 0000006c beafe648 0001056c b6eb6944 ---[ end trace d4b8409def9b8b1f ]--- The reason for this warning is the attempt to get the chip->dev reference in tpm_common_write() although the reference counter is already zero. Since commit 8979b02aaf1d ("tpm: Fix reference count to main device") the extra reference used to prevent a premature zero counter is never taken, because the required TPM_CHIP_FLAG_TPM2 flag is never set. Fix this by moving the TPM 2 character device handling from tpm_chip_alloc() to tpm_add_char_device() which is called at a later point in time when the flag has been set in case of TPM2. Commit fdc915f7f719 ("tpm: expose spaces via a device link /dev/tpmrm") already introduced function tpm_devs_release() to release the extra reference but did not implement the required put on chip->devs that results in the call of this function. Fix this by putting chip->devs in tpm_chip_unregister(). Finally move the new implementation for the TPM 2 handling into a new function to avoid multiple checks for the TPM_CHIP_FLAG_TPM2 flag in the good case and error cases.27:["$","meta","14",{"property":"og:description","content":"$41"}] 28:["$","meta","15",{"property":"og:url","content":"https://hol.org/guard/security/cves/CVE-2022-49287-tpm-fix-reference-counting-for-struct-tpmchip"}] 29:["$","meta","16",{"property":"og:site_name","content":"HOL Guard"}] 2a:["$","meta","17",{"property":"og:image","content":"https://hol.org/guard/og/cve"}] 2b:["$","meta","18",{"property":"og:image:width","content":"1200"}] 2c:["$","meta","19",{"property":"og:image:height","content":"630"}] 2d:["$","meta","20",{"property":"og:image:alt","content":"tpm: fix reference counting for struct tpm_chip (CVE-2022-49287) | HOL Guard CVE"}] 2e:["$","meta","21",{"property":"og:type","content":"article"}] 2f:["$","meta","22",{"property":"article:published_time","content":"2025-02-26T01:56:26.059Z"}] 30:["$","meta","23",{"property":"article:modified_time","content":"2026-08-05T08:54:36.034Z"}] 31:["$","meta","24",{"property":"article:author","content":"HOL Guard"}] 32:["$","meta","25",{"property":"article:tag","content":"CVE-2022-49287"}] 33:["$","meta","26",{"property":"article:tag","content":"high"}] 34:["$","meta","27",{"property":"article:tag","content":"generic"}] 35:["$","meta","28",{"name":"twitter:card","content":"summary_large_image"}] 36:["$","meta","29",{"name":"twitter:site","content":"@HashgraphOnline"}] 37:["$","meta","30",{"name":"twitter:creator","content":"@HashgraphOnline"}] 38:["$","meta","31",{"name":"twitter:title","content":"tpm: fix reference counting for struct tpm_chip (CVE-2022-49287) | HOL Guard CVE"}] 42:Tb6e,In the Linux kernel, the following vulnerability has been resolved: tpm: fix reference counting for struct tpm_chip The following sequence of operations results in a refcount warning: 1. Open device /dev/tpmrm. 2. Remove module tpm_tis_spi. 3. Write a TPM command to the file descriptor opened at step 1. ------------[ cut here ]------------ WARNING: CPU: 3 PID: 1161 at lib/refcount.c:25 kobject_get+0xa0/0xa4 refcount_t: addition on 0; use-after-free. Modules linked in: tpm_tis_spi tpm_tis_core tpm mdio_bcm_unimac brcmfmac sha256_generic libsha256 sha256_arm hci_uart btbcm bluetooth cfg80211 vc4 brcmutil ecdh_generic ecc snd_soc_core crc32_arm_ce libaes raspberrypi_hwmon ac97_bus snd_pcm_dmaengine bcm2711_thermal snd_pcm snd_timer genet snd phy_generic soundcore [last unloaded: spi_bcm2835] CPU: 3 PID: 1161 Comm: hold_open Not tainted 5.10.0ls-main-dirty #2 Hardware name: BCM2711 [] (unwind_backtrace) from [] (show_stack+0x10/0x14) [] (show_stack) from [] (dump_stack+0xc4/0xd8) [] (dump_stack) from [] (__warn+0x104/0x108) [] (__warn) from [] (warn_slowpath_fmt+0x74/0xb8) [] (warn_slowpath_fmt) from [] (kobject_get+0xa0/0xa4) [] (kobject_get) from [] (tpm_try_get_ops+0x14/0x54 [tpm]) [] (tpm_try_get_ops [tpm]) from [] (tpm_common_write+0x38/0x60 [tpm]) [] (tpm_common_write [tpm]) from [] (vfs_write+0xc4/0x3c0) [] (vfs_write) from [] (ksys_write+0x58/0xcc) [] (ksys_write) from [] (ret_fast_syscall+0x0/0x4c) Exception stack(0xc226bfa8 to 0xc226bff0) bfa0: 00000000 000105b4 00000003 beafe664 00000014 00000000 bfc0: 00000000 000105b4 000103f8 00000004 00000000 00000000 b6f9c000 beafe684 bfe0: 0000006c beafe648 0001056c b6eb6944 ---[ end trace d4b8409def9b8b1f ]--- The reason for this warning is the attempt to get the chip->dev reference in tpm_common_write() although the reference counter is already zero. Since commit 8979b02aaf1d ("tpm: Fix reference count to main device") the extra reference used to prevent a premature zero counter is never taken, because the required TPM_CHIP_FLAG_TPM2 flag is never set. Fix this by moving the TPM 2 character device handling from tpm_chip_alloc() to tpm_add_char_device() which is called at a later point in time when the flag has been set in case of TPM2. Commit fdc915f7f719 ("tpm: expose spaces via a device link /dev/tpmrm") already introduced function tpm_devs_release() to release the extra reference but did not implement the required put on chip->devs that results in the call of this function. Fix this by putting chip->devs in tpm_chip_unregister(). Finally move the new implementation for the TPM 2 handling into a new function to avoid multiple checks for the TPM_CHIP_FLAG_TPM2 flag in the good case and error cases.39:["$","meta","32",{"name":"twitter:description","content":"$42"}] 3a:["$","meta","33",{"name":"twitter:image","content":"https://hol.org/guard/og/cve"}] 3b:["$","link","34",{"rel":"icon","href":"/favicon.ico?favicon.1axbsr3zo-yoa.ico","sizes":"48x48","type":"image/x-icon"}] 3c:["$","link","35",{"rel":"icon","href":"/points/favicon.ico","sizes":"48x48"}] 3d:["$","link","36",{"rel":"icon","href":"/points/icon-192x192.png","sizes":"192x192","type":"image/png"}] 3e:["$","link","37",{"rel":"icon","href":"/points/icon-512x512.png","sizes":"512x512","type":"image/png"}] 3f:["$","link","38",{"rel":"apple-touch-icon","href":"/points/apple-touch-icon.png","sizes":"180x180","type":"image/png"}] 40:["$","$L43","39",{}]