CVE-2022-48820

What it actually does

A reference count leak occurs in the error path of stm32_usbphyc_pll_enable() because usbphyc->n_pll_cons.counter is not decremented before returning, resulting in a resource leak that can contribute to memory corruption or exhaustion in the Linux kernel STM32 USB PHY driver.

Why it matters to the business

Affected Linux systems on STM32 hardware risk resource exhaustion or instability that can disrupt embedded, IoT, or USB-dependent operations; widespread package impact across Debian and Ubuntu distributions increases the scope of required updates.

How an attack unfolds

An attacker triggers the error path in stm32_usbphyc_pll_enable() through repeated USB PHY initialization or driver interactions to accumulate reference count leaks, potentially leading to denial of service or facilitating further attacks when combined with other kernel flaws.

How to fix it

Upgrade affected packages to the listed fixed versions including linux 5.16.7-1 on Debian 12/13, 5.15.0-22.22 on Ubuntu 22.04 LTS, 5.15.0-1002.4 on linux-aws 22.04 LTS, and corresponding per-package fixes such as 5.15.0-1014.18~20.04.1 for linux-aws-5.15 on Ubuntu 20.04 LTS.

How to confirm the fix worked

Confirm the running kernel matches one of the specified fixed versions for the distribution and package; review source for the corrected decrement in stm32_usbphyc_pll_enable() error path.

Typical attack path

1. Identify systems running vulnerable STM32 USB PHY driver versions
2. Trigger error conditions during PLL enable operations
3. Repeat triggering to accumulate reference count leaks
4. Induce resource exhaustion or kernel instability

How to detect it

Examine kernel logs for repeated stm32_usbphyc or USB PHY initialization errors and warnings; check for unexpected reference count behavior or resource exhaustion symptoms in dmesg output.

What your security team should do

• Apply kernel package updates to fixed versions immediately on affected systems
• Prioritize testing and deployment on STM32-based devices first
• Monitor kernel logs for USB PHY related warnings during rollout