| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2022-49021: net: phy: fix null-ptr-deref while probe() failed |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| net: phy: fix null-ptr-deref while probe() failed |
| |
| I got a null-ptr-deref report as following when doing fault injection test: |
| |
| BUG: kernel NULL pointer dereference, address: 0000000000000058 |
| Oops: 0000 [#1] PREEMPT SMP KASAN PTI |
| CPU: 1 PID: 253 Comm: 507-spi-dm9051 Tainted: G B N 6.1.0-rc3+ |
| Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 |
| RIP: 0010:klist_put+0x2d/0xd0 |
| Call Trace: |
| <TASK> |
| klist_remove+0xf1/0x1c0 |
| device_release_driver_internal+0x23e/0x2d0 |
| bus_remove_device+0x1bd/0x240 |
| device_del+0x357/0x770 |
| phy_device_remove+0x11/0x30 |
| mdiobus_unregister+0xa5/0x140 |
| release_nodes+0x6a/0xa0 |
| devres_release_all+0xf8/0x150 |
| device_unbind_cleanup+0x19/0xd0 |
| |
| //probe path: |
| phy_device_register() |
| device_add() |
| |
| phy_connect |
| phy_attach_direct() //set device driver |
| probe() //it's failed, driver is not bound |
| device_bind_driver() // probe failed, it's not called |
| |
| //remove path: |
| phy_device_remove() |
| device_del() |
| device_release_driver_internal() |
| __device_release_driver() //dev->drv is not NULL |
| klist_remove() <- knode_driver is not added yet, cause null-ptr-deref |
| |
| In phy_attach_direct(), after setting the 'dev->driver', probe() fails, |
| device_bind_driver() is not called, so the knode_driver->n_klist is not |
| set, then it causes null-ptr-deref in __device_release_driver() while |
| deleting device. Fix this by setting dev->driver to NULL in the error |
| path in phy_attach_direct(). |
| |
| The Linux kernel CVE team has assigned CVE-2022-49021 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 2.6.14 with commit e13934563db047043ccead26412f552375cea90c and fixed in 4.9.335 with commit 8aaafe0f71314f46a066382a047ba8bb3840d273 |
| Issue introduced in 2.6.14 with commit e13934563db047043ccead26412f552375cea90c and fixed in 4.14.301 with commit 51d7f6b20fae8bae64ad1136f1e30d1fd5ba78f7 |
| Issue introduced in 2.6.14 with commit e13934563db047043ccead26412f552375cea90c and fixed in 4.19.268 with commit 0744c7be4de564db03e24527b2e096b7e0e20972 |
| Issue introduced in 2.6.14 with commit e13934563db047043ccead26412f552375cea90c and fixed in 5.4.226 with commit 3e21f85d87c836462bb52ef2078ea561260935c1 |
| Issue introduced in 2.6.14 with commit e13934563db047043ccead26412f552375cea90c and fixed in 5.10.158 with commit fe6bc99c27c21348f548966118867ed26a9a372c |
| Issue introduced in 2.6.14 with commit e13934563db047043ccead26412f552375cea90c and fixed in 5.15.82 with commit 7730904f50c7187dd16c76949efb56b5fb55cd57 |
| Issue introduced in 2.6.14 with commit e13934563db047043ccead26412f552375cea90c and fixed in 6.0.12 with commit eaa5722549ac2604ffa56c2e946acc83226f130c |
| Issue introduced in 2.6.14 with commit e13934563db047043ccead26412f552375cea90c and fixed in 6.1 with commit 369eb2c9f1f72adbe91e0ea8efb130f0a2ba11a6 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2022-49021 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/net/phy/phy_device.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/8aaafe0f71314f46a066382a047ba8bb3840d273 |
| https://git.kernel.org/stable/c/51d7f6b20fae8bae64ad1136f1e30d1fd5ba78f7 |
| https://git.kernel.org/stable/c/0744c7be4de564db03e24527b2e096b7e0e20972 |
| https://git.kernel.org/stable/c/3e21f85d87c836462bb52ef2078ea561260935c1 |
| https://git.kernel.org/stable/c/fe6bc99c27c21348f548966118867ed26a9a372c |
| https://git.kernel.org/stable/c/7730904f50c7187dd16c76949efb56b5fb55cd57 |
| https://git.kernel.org/stable/c/eaa5722549ac2604ffa56c2e946acc83226f130c |
| https://git.kernel.org/stable/c/369eb2c9f1f72adbe91e0ea8efb130f0a2ba11a6 |
