CVE-2022-49287 is a high-severity vulnerability in the Linux kernel's TPM (Trusted Platform Module) subsystem, specifically related to reference counting for the struct tpm_chip. The flaw arises from improper management of reference counts when interacting with TPM devices, particularly TPM 2.0 character devices. The vulnerability manifests when a user opens the /dev/tpmrm device, removes the tpm_tis_spi kernel module, and then writes a TPM command to the previously opened file descriptor. This sequence triggers a use-after-free condition due to an attempt to increment a reference count that has already reached zero, leading to a refcount warning and potential kernel memory corruption. The root cause is that since commit 8979b02aaf1d, an extra reference intended to prevent premature zeroing of the reference counter is never taken because the TPM_CHIP_FLAG_TPM2 flag is not set at the correct time. The fix involves moving TPM 2 character device handling from tpm_chip_alloc() to tpm_add_char_device(), which is invoked after the TPM2 flag is set, and ensuring proper release of references in tpm_chip_unregister(). This vulnerability is classified under CWE-416 (Use After Free) and has a CVSS 3.1 score of 7.8, indicating high severity. Exploitation requires local privileges (low attack vector), low complexity, and privileges to interact with TPM devices, but no user interaction. While no known exploits are currently reported in the wild, the vulnerability could allow an attacker with local access to cause kernel crashes, escalate privileges, or execute arbitrary code by exploiting the use-after-free condition in the TPM driver.

For European organizations, this vulnerability poses significant risk primarily to systems running Linux kernels with TPM 2.0 support, especially those using TPM for hardware-based security functions such as secure boot, disk encryption, or cryptographic key storage. Exploitation could lead to kernel crashes (denial of service), privilege escalation, or arbitrary code execution at the kernel level, undermining system integrity and confidentiality. This is particularly critical for sectors relying on TPM for compliance and security assurance, including finance, healthcare, government, and critical infrastructure. The vulnerability could compromise the trustworthiness of TPM-based security mechanisms, potentially exposing sensitive cryptographic keys or allowing attackers to bypass security controls. Given the widespread use of Linux in servers, embedded devices, and cloud infrastructure across Europe, the impact could be broad, affecting enterprise servers, cloud providers, and IoT devices. The requirement for local privileges limits remote exploitation but does not eliminate risk from insider threats or attackers who gain initial access through other means.

European organizations should prioritize updating Linux kernels to versions that include the patch for CVE-2022-49287 as soon as vendor updates are available. Until patches are applied, organizations should restrict access to TPM devices (/dev/tpmrm and related interfaces) to trusted users only, enforce strict access controls, and monitor for suspicious module unload/load activities. Employing kernel lockdown features and mandatory access control frameworks (e.g., SELinux, AppArmor) can help limit the ability of unprivileged users to interact with TPM devices or unload kernel modules. Additionally, organizations should audit systems for the presence of vulnerable kernel versions and TPM 2.0 usage, and consider isolating critical systems to reduce the risk of local exploitation. For embedded or IoT devices, coordinate with vendors to obtain patched firmware or kernel updates. Implementing comprehensive endpoint detection and response (EDR) solutions can help detect anomalous behavior indicative of exploitation attempts. Finally, maintain robust incident response plans to quickly address potential exploitation scenarios involving kernel-level vulnerabilities.