CVE-2022-48997

What it actually does

Race condition in tpm_pm_suspend allows concurrent TPM transactions with hw_random kthread calls to tpm_get_random, resulting in transmit errors and invalid TPM_STS states during suspend.

Why it matters to the business

System suspend/resume operations may fail or produce TPM device errors on affected Linux systems, reducing reliability for workloads relying on TPM-backed random number generation; low exploitability but impacts availability during power management.

How an attack unfolds

An attacker triggers system suspend while a kernel thread continuously calls tpm_get_random from hw_random, racing with tpm_pm_suspend and causing TPM command failures; listed threat actors reference related kernel resource and write issues but no confirmed active exploitation for this race.

How to fix it

Apply kernel patches that wrap TPM operations with tpm_try_get_ops for proper mutex protection; for listed astro packages upgrade to a4ffbfaa5cb460c12bd486fd75e36147f51d3e5e or c73d65d7f76617cf5275203fd918887cbda01baf.

How to confirm the fix worked

Confirm presence of tpm_try_get_ops call in tpm_pm_suspend path; reproduce suspend under load from hw_random and verify absence of error -52 and invalid TPM_STS logs.

Typical attack path

1. Initiate system suspend via power management
2. Concurrently invoke TPM random generation from unfrozen kthread
3. Trigger unprotected tpm_transmit in tpm_pm_suspend
4. Observe race-induced errors and invalid device state

How to detect it

Search kernel logs and dmesg for TPM transmit failures during suspend events; correlate with hw_random kthread activity and stack traces mentioning tpm1_pm_suspend.

• tpm tpm0: tpm_transmit: tpm_recv: error -52
• tpm tpm0: invalid TPM_STS.x 0xff, dumping stack for forensics
• tpm_tis_status.cold
• tpm1_pm_suspend

What your security team should do

• Prioritize kernel updates on systems using TPM and hw_random
• Monitor suspend logs for TPM transmit errors during testing
• Review power management code for similar unprotected device access