cve/published/2022/CVE-2022-49326.mbox

From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: <linux-cve-announce@vger.kernel.org>
Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
Subject: CVE-2022-49326: rtl818x: Prevent using not initialized queues

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

rtl818x: Prevent using not initialized queues

Using not existing queues can panic the kernel with rtl8180/rtl8185 cards.
Ignore the skb priority for those cards, they only have one tx queue. Pierre
Asselin (pa@panix.com) reported the kernel crash in the Gentoo forum:

https://forums.gentoo.org/viewtopic-t-1147832-postdays-0-postorder-asc-start-25.html

He also confirmed that this patch fixes the issue. In summary this happened:

After updating wpa_supplicant from 2.9 to 2.10 the kernel crashed with a
"divide error: 0000" when connecting to an AP. Control port tx now tries to
use IEEE80211_AC_VO for the priority, which wpa_supplicants starts to use in
2.10.

Since only the rtl8187se part of the driver supports QoS, the priority
of the skb is set to IEEE80211_AC_BE (2) by mac80211 for rtl8180/rtl8185
cards.

rtl8180 is then unconditionally reading out the priority and finally crashes on
drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c line 544 without this
patch:
	idx = (ring->idx + skb_queue_len(&ring->queue)) % ring->entries

"ring->entries" is zero for rtl8180/rtl8185 cards, tx_ring[2] never got
initialized.

The Linux kernel CVE team has assigned CVE-2022-49326 to this issue.


Affected and fixed versions
===========================

	Fixed in 4.9.318 with commit b5dca2cd3f0239512da808598b4e70557eb4c2a1
	Fixed in 4.14.283 with commit d7e30dfc166d33470bba31a42f9bbc346e5409d5
	Fixed in 4.19.247 with commit 9d5e96cc1f1720019ce27b127a31695148d38bb0
	Fixed in 5.4.198 with commit b8ce58ab80faaea015c206382041ff3bcf5495ff
	Fixed in 5.10.121 with commit 769ec2a824deae2f1268dfda14999a4d14d0d0c5
	Fixed in 5.15.46 with commit 6ad81ad0cf5744738ce94c8e64051ddd80a1734c
	Fixed in 5.17.14 with commit 9ad1981fc4de3afb7db3e8eb5a6a52d4c7d0d577
	Fixed in 5.18.3 with commit 98e55b0b876bde3353f4e074883d66ecb55c65a3
	Fixed in 5.19 with commit 746285cf81dc19502ab238249d75f5990bd2d231

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-49326
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/b5dca2cd3f0239512da808598b4e70557eb4c2a1
	https://git.kernel.org/stable/c/d7e30dfc166d33470bba31a42f9bbc346e5409d5
	https://git.kernel.org/stable/c/9d5e96cc1f1720019ce27b127a31695148d38bb0
	https://git.kernel.org/stable/c/b8ce58ab80faaea015c206382041ff3bcf5495ff
	https://git.kernel.org/stable/c/769ec2a824deae2f1268dfda14999a4d14d0d0c5
	https://git.kernel.org/stable/c/6ad81ad0cf5744738ce94c8e64051ddd80a1734c
	https://git.kernel.org/stable/c/9ad1981fc4de3afb7db3e8eb5a6a52d4c7d0d577
	https://git.kernel.org/stable/c/98e55b0b876bde3353f4e074883d66ecb55c65a3
	https://git.kernel.org/stable/c/746285cf81dc19502ab238249d75f5990bd2d231