CVE-2022-48630

What it actually does

The qcom-rng driver enters an infinite loop in qcom_rng_read() when the requested byte count is not a multiple of WORD_SZ because a required break statement was removed from the else branch.

Why it matters to the business

Systems relying on Qualcomm RNG hardware for cryptographic operations may experience kernel-level hangs or denial of service when applications request non-multiple word sizes of random data, disrupting services and requiring reboots.

How an attack unfolds

An attacker with the ability to invoke the RNG interface (for example via userspace tools or applications) supplies a request length that is not a multiple of WORD_SZ, triggering the faulty loop condition and causing the process or system to hang.

How to fix it

Upgrade the Linux kernel to a fixed version such as 4.19.245 or apply the commit 71a89789552b7faf3ef27969b9bc783fa0df3550. Rebuild and reboot with the patched kernel; avoid using affected qcom-rng configurations until updated.

How to confirm the fix worked

Confirm the running kernel version is at or above the fixed releases, then execute the reproduction command kcapi-rng -b 67 and verify it completes without hanging. Monitor for the presence of the restored break statement in the qcom_rng_read function via source inspection or binary analysis.

Typical attack path

1. Identify a system using the qcom-rng driver
2. Obtain local execution context or trigger an application that calls the RNG interface
3. Issue a read request with byte length not divisible by WORD_SZ (for example 67 bytes)
4. Observe the infinite loop causing resource exhaustion or unresponsiveness

How to detect it

Review system logs for repeated or hung processes invoking the RNG interface, monitor for high CPU usage in kernel RNG paths, and inspect audit logs for invocations of kcapi-rng or equivalent RNG consumers with non-standard lengths.

What your security team should do

• Prioritize kernel updates on all systems exposing the qcom-rng driver
• Inventory devices using Qualcomm Amberwing or similar RNG hardware
• Test patched kernels in staging before broad deployment
• Disable the qcom-rng module temporarily if updates cannot be applied immediately