In the Linux kernel, the following vulnerability has been resolved:
net: ieee802154: at86rf230: Stop leaking skb's
Upon error the ieee802154xmitcomplete() helper is not called. Only ieee802154wakequeue() is called manually. In the Tx case we then leak the skb structure.
Free the skb structure upon error before returning when appropriate.
As the 'istx = 0' cannot be moved in the complete handler because of a possible race between the delay in switching to STATERXAACKON and a new interrupt, we introduce an intermediate 'was_tx' boolean just for this purpose.
There is no Fixes tag applying here, many changes have been made on this area and the issue kind of always existed.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@23b2a25382400168427ea278f3d8bf4ecfd333bf",
"target": {
"function": "at86rf230_async_error_recover_complete",
"file": "drivers/net/ieee802154/at86rf230.c"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2022-48794-01638361",
"digest": {
"function_hash": "293252648226422890449528469540019298862",
"length": 155.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1c72f04d52b7200bb83426a9bed378668271ea4a",
"target": {
"function": "at86rf230_async_error_recover",
"file": "drivers/net/ieee802154/at86rf230.c"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2022-48794-04d05695",
"digest": {
"function_hash": "205166416311468152486414313041101177425",
"length": 196.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@455ef08d6e5473526fa6763f75a93f7198206966",
"target": {
"function": "at86rf230_async_error_recover_complete",
"file": "drivers/net/ieee802154/at86rf230.c"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2022-48794-0eda69ae",
"digest": {
"function_hash": "293252648226422890449528469540019298862",
"length": 155.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@af649e5c95f56df64363bc46f6746b87819f9c0d",
"target": {
"function": "at86rf230_async_error_recover_complete",
"file": "drivers/net/ieee802154/at86rf230.c"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2022-48794-1acf326b",
"digest": {
"function_hash": "293252648226422890449528469540019298862",
"length": 155.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1c72f04d52b7200bb83426a9bed378668271ea4a",
"target": {
"file": "drivers/net/ieee802154/at86rf230.c"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2022-48794-2882f050",
"digest": {
"line_hashes": [
"207722970236551356475970694708376684564",
"7670740649353780980331970739719816673",
"59847836328113329851006209570737859275",
"203993903396593103037282141831791592213",
"97995006831151487182330397022618792276",
"3957477968341771052631696777592797300",
"255168072077063357165181720630417078083",
"248748527251715448121122931650098646170",
"278449685286523123134278153224963924984",
"123976451317791732623870474327914861332",
"186468104317045269724397250198839496898",
"293217027885710914558056515617620896992"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e5ce576d45bf72fd0e3dc37eff897bfcc488f6a9",
"target": {
"file": "drivers/net/ieee802154/at86rf230.c"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2022-48794-39befacf",
"digest": {
"line_hashes": [
"207722970236551356475970694708376684564",
"7670740649353780980331970739719816673",
"59847836328113329851006209570737859275",
"203993903396593103037282141831791592213",
"97995006831151487182330397022618792276",
"3957477968341771052631696777592797300",
"255168072077063357165181720630417078083",
"248748527251715448121122931650098646170",
"278449685286523123134278153224963924984",
"123976451317791732623870474327914861332",
"186468104317045269724397250198839496898",
"293217027885710914558056515617620896992"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@455ef08d6e5473526fa6763f75a93f7198206966",
"target": {
"file": "drivers/net/ieee802154/at86rf230.c"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2022-48794-4353c853",
"digest": {
"line_hashes": [
"207722970236551356475970694708376684564",
"7670740649353780980331970739719816673",
"59847836328113329851006209570737859275",
"203993903396593103037282141831791592213",
"97995006831151487182330397022618792276",
"3957477968341771052631696777592797300",
"255168072077063357165181720630417078083",
"248748527251715448121122931650098646170",
"278449685286523123134278153224963924984",
"123976451317791732623870474327914861332",
"186468104317045269724397250198839496898",
"293217027885710914558056515617620896992"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0fd484644c68897c490a3307bfcc8bf767df5a43",
"target": {
"function": "at86rf230_async_error_recover",
"file": "drivers/net/ieee802154/at86rf230.c"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2022-48794-4e74eba7",
"digest": {
"function_hash": "205166416311468152486414313041101177425",
"length": 196.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1c72f04d52b7200bb83426a9bed378668271ea4a",
"target": {
"function": "at86rf230_async_error_recover_complete",
"file": "drivers/net/ieee802154/at86rf230.c"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2022-48794-57b4fbe6",
"digest": {
"function_hash": "293252648226422890449528469540019298862",
"length": 155.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d2a1eaf51b7d4412319adb6acef114ba472d1692",
"target": {
"file": "drivers/net/ieee802154/at86rf230.c"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2022-48794-62f83126",
"digest": {
"line_hashes": [
"207722970236551356475970694708376684564",
"7670740649353780980331970739719816673",
"59847836328113329851006209570737859275",
"203993903396593103037282141831791592213",
"97995006831151487182330397022618792276",
"3957477968341771052631696777592797300",
"255168072077063357165181720630417078083",
"248748527251715448121122931650098646170",
"278449685286523123134278153224963924984",
"123976451317791732623870474327914861332",
"186468104317045269724397250198839496898",
"293217027885710914558056515617620896992"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@af649e5c95f56df64363bc46f6746b87819f9c0d",
"target": {
"function": "at86rf230_async_error_recover",
"file": "drivers/net/ieee802154/at86rf230.c"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2022-48794-71102c1e",
"digest": {
"function_hash": "205166416311468152486414313041101177425",
"length": 196.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@af649e5c95f56df64363bc46f6746b87819f9c0d",
"target": {
"file": "drivers/net/ieee802154/at86rf230.c"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2022-48794-7f557787",
"digest": {
"line_hashes": [
"207722970236551356475970694708376684564",
"7670740649353780980331970739719816673",
"59847836328113329851006209570737859275",
"203993903396593103037282141831791592213",
"97995006831151487182330397022618792276",
"3957477968341771052631696777592797300",
"255168072077063357165181720630417078083",
"248748527251715448121122931650098646170",
"278449685286523123134278153224963924984",
"123976451317791732623870474327914861332",
"186468104317045269724397250198839496898",
"293217027885710914558056515617620896992"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0fd484644c68897c490a3307bfcc8bf767df5a43",
"target": {
"file": "drivers/net/ieee802154/at86rf230.c"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2022-48794-9e7f9348",
"digest": {
"line_hashes": [
"207722970236551356475970694708376684564",
"7670740649353780980331970739719816673",
"59847836328113329851006209570737859275",
"203993903396593103037282141831791592213",
"97995006831151487182330397022618792276",
"3957477968341771052631696777592797300",
"255168072077063357165181720630417078083",
"248748527251715448121122931650098646170",
"278449685286523123134278153224963924984",
"123976451317791732623870474327914861332",
"186468104317045269724397250198839496898",
"293217027885710914558056515617620896992"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e5ce576d45bf72fd0e3dc37eff897bfcc488f6a9",
"target": {
"function": "at86rf230_async_error_recover",
"file": "drivers/net/ieee802154/at86rf230.c"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2022-48794-a285a7cd",
"digest": {
"function_hash": "205166416311468152486414313041101177425",
"length": 196.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d2a1eaf51b7d4412319adb6acef114ba472d1692",
"target": {
"function": "at86rf230_async_error_recover_complete",
"file": "drivers/net/ieee802154/at86rf230.c"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2022-48794-c4d93c09",
"digest": {
"function_hash": "293252648226422890449528469540019298862",
"length": 155.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0fd484644c68897c490a3307bfcc8bf767df5a43",
"target": {
"function": "at86rf230_async_error_recover_complete",
"file": "drivers/net/ieee802154/at86rf230.c"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2022-48794-d5543b7f",
"digest": {
"function_hash": "293252648226422890449528469540019298862",
"length": 155.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e5ce576d45bf72fd0e3dc37eff897bfcc488f6a9",
"target": {
"function": "at86rf230_async_error_recover_complete",
"file": "drivers/net/ieee802154/at86rf230.c"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2022-48794-e4b4d95f",
"digest": {
"function_hash": "293252648226422890449528469540019298862",
"length": 155.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d2a1eaf51b7d4412319adb6acef114ba472d1692",
"target": {
"function": "at86rf230_async_error_recover",
"file": "drivers/net/ieee802154/at86rf230.c"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2022-48794-ea26ef55",
"digest": {
"function_hash": "205166416311468152486414313041101177425",
"length": 196.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@23b2a25382400168427ea278f3d8bf4ecfd333bf",
"target": {
"file": "drivers/net/ieee802154/at86rf230.c"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2022-48794-eeff9208",
"digest": {
"line_hashes": [
"207722970236551356475970694708376684564",
"7670740649353780980331970739719816673",
"59847836328113329851006209570737859275",
"203993903396593103037282141831791592213",
"97995006831151487182330397022618792276",
"3957477968341771052631696777592797300",
"255168072077063357165181720630417078083",
"248748527251715448121122931650098646170",
"278449685286523123134278153224963924984",
"123976451317791732623870474327914861332",
"186468104317045269724397250198839496898",
"293217027885710914558056515617620896992"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@455ef08d6e5473526fa6763f75a93f7198206966",
"target": {
"function": "at86rf230_async_error_recover",
"file": "drivers/net/ieee802154/at86rf230.c"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2022-48794-f29241c0",
"digest": {
"function_hash": "205166416311468152486414313041101177425",
"length": 196.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@23b2a25382400168427ea278f3d8bf4ecfd333bf",
"target": {
"function": "at86rf230_async_error_recover",
"file": "drivers/net/ieee802154/at86rf230.c"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2022-48794-f980079a",
"digest": {
"function_hash": "205166416311468152486414313041101177425",
"length": 196.0
}
}
]