CVE-2022-50370— i2c: designware: Fix handling of real but unexpected device interrupts
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2022-50370
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
i2c: designware: Fix handling of real but unexpected device interrupts
Source: NVD (National Vulnerability Database)
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: i2c: designware: Fix handling of real but unexpected device interrupts Commit c7b79a752871 ("mfd: intel-lpss: Add Intel Alder Lake PCH-S PCI IDs") caused a regression on certain Gigabyte motherboards for Intel Alder Lake-S where system crashes to NULL pointer dereference in i2c_dw_xfer_msg() when system resumes from S3 sleep state ("deep"). I was able to debug the issue on Gigabyte Z690 AORUS ELITE and made following notes: - Issue happens when resuming from S3 but not when resuming from "s2idle" - PCI device 00:15.0 == i2c_designware.0 is already in D0 state when system enters into pci_pm_resume_noirq() while all other i2c_designware PCI devices are in D3. Devices were runtime suspended and in D3 prior entering into suspend - Interrupt comes after pci_pm_resume_noirq() when device interrupts are re-enabled - According to register dump the interrupt really comes from the i2c_designware.0. Controller is enabled, I2C target address register points to a one detectable I2C device address 0x60 and the DW_IC_RAW_INTR_STAT register START_DET, STOP_DET, ACTIVITY and TX_EMPTY bits are set indicating completed I2C transaction. My guess is that the firmware uses this controller to communicate with an on-board I2C device during resume but does not disable the controller before giving control to an operating system. I was told the UEFI update fixes this but never the less it revealed the driver is not ready to handle TX_EMPTY (or RX_FULL) interrupt when device is supposed to be idle and state variables are not set (especially the dev->msgs pointer which may point to NULL or stale old data). Introduce a new software status flag STATUS_ACTIVE indicating when the controller is active in driver point of view. Now treat all interrupts that occur when is not set as unexpected and mask all interrupts from the controller.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于i2c_designware设备中断处理不当，可能导致空指针取消引用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2022-50370
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-50370
请登录查看更多情报信息。
Same Patch Batch · Linux · 2025-09-17 · 56 CVEs total
| CVE-2022-50371 | led: qcom-lpg: Fix sleeping in atomic | |
| CVE-2022-50355 | staging: vt6655: fix some erroneous memory clean-up loops | |
| CVE-2022-50358 | brcmfmac: return error when getting invalid max_flowrings from dongle | |
| CVE-2022-50356 | net: sched: sfb: fix null pointer access issue when sfb_init() fails | |
| CVE-2022-50357 | usb: dwc3: core: fix some leaks in probe | |
| CVE-2022-50359 | media: cx88: Fix a null-ptr-deref bug in buffer_prepare() | |
| CVE-2022-50354 | drm/amdkfd: Fix kfd_process_device_init_vm error handling | |
| CVE-2022-50367 | fs: fix UAF/GPF bug in nilfs_mdt_destroy | |
| CVE-2022-50368 | drm/msm/dsi: fix memory corruption with too many bridges | |
| CVE-2022-50369 | drm/vkms: Fix null-ptr-deref in vkms_release() | |
| CVE-2022-50366 | powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue | |
| CVE-2022-50372 | cifs: Fix memory leak when build ntlmssp negotiate blob failed | |
| CVE-2022-50373 | fs: dlm: fix race in lowcomms | |
| CVE-2022-50374 | Bluetooth: hci_{ldisc,serdev}: check percpu_init_rwsem() failure | |
| CVE-2023-53335 | RDMA/cxgb4: Fix potential null-ptr-deref in pass_establish() | |
| CVE-2023-53336 | media: ipu-bridge: Fix null pointer deref on SSDB/PLD parsing warnings | |
| CVE-2023-53337 | nilfs2: do not write dirty data after degenerating to read-only | |
| CVE-2023-53338 | lwt: Fix return values of BPF xmit ops | |
| CVE-2023-53339 | btrfs: fix BUG_ON condition in btrfs_cancel_balance | |
| CVE-2023-53340 | net/mlx5: Collect command failures data only for known commands |
Showing top 20 of 56 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-43500
rxrpc: Also unshare DATA/RESPONSE packets when paged frags a - CVE-2026-43475
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT - CVE-2026-43474
fs: init flags_valid before calling vfs_fileattr_get - CVE-2026-43473
scsi: mpi3mr: Add NULL checks when resetting request and rep - CVE-2026-43472
unshare: fix unshare_fs() handling
Same vendor: Linux
- CVE-2026-43500
rxrpc: Also unshare DATA/RESPONSE packets when paged frags a - CVE-2026-43475
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT - CVE-2026-43474
fs: init flags_valid before calling vfs_fileattr_get - CVE-2026-43473
scsi: mpi3mr: Add NULL checks when resetting request and rep - CVE-2026-43472
unshare: fix unshare_fs() handling
V. Comments for CVE-2022-50370
No comments yet