CVE-2022-48870
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2022-48870
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-48870.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2022-48870
- Downstream
- Related
- Published
- 2024-08-21T06:10:00Z
- Modified
- 2025-10-21T07:56:33.716628Z
- Summary
- tty: fix possible null-ptr-defer in spk_ttyio_release
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
tty: fix possible null-ptr-defer in spkttyiorelease
Run the following tests on the qemu platform:
syzkaller:~# modprobe speakup_audptr input: Speakup as /devices/virtual/input/input4 initialized device: /dev/synth, node (MAJOR 10, MINOR 125) speakup 3.1.6: initialized synth name on entry is: (null) synth probe
spkttyioinitialiseldisc failed because ttykopen_exclusive returned failed (errno -16), then remove the module, we will get a null-ptr-defer problem, as follow:
syzkaller:~# modprobe -r speakupaudptr releasing synth audptr BUG: kernel NULL pointer dereference, address: 0000000000000080 #PF: supervisor write access in kernel mode #PF: errorcode(0x0002) - not-present page PGD 0 P4D 0 Oops: 0002 [#1] PREEMPT SMP PTI CPU: 2 PID: 204 Comm: modprobe Not tainted 6.1.0-rc6-dirty #1 RIP: 0010:mutexlock+0x14/0x30 Call Trace: <TASK> spkttyiorelease+0x19/0x70 [speakup] synthrelease.part.6+0xac/0xc0 [speakup] synthremove+0x56/0x60 [speakup] _x64sysdeletemodule+0x156/0x250 ? fpregsassertstateconsistent+0x1d/0x50 dosyscall64+0x37/0x90 entrySYSCALL64afterhwframe+0x63/0xcd </TASK> Modules linked in: speakup_audptr(-) speakup Dumping ftrace buffer:
insynth->dev was not initialized during modprobe, so we add check for insynth->dev to fix this bug.
- References
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced4f2a81f3a88217e7340b2cab5c0a5ebd0112514cFixed2da67bff29ab49caafb0766e8b8383b735ff796f
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced4f2a81f3a88217e7340b2cab5c0a5ebd0112514cFixed64152e05a4de3ebf59f1740a0985a6d5fba0c77b
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced4f2a81f3a88217e7340b2cab5c0a5ebd0112514cFixed5abbeebd8296c2301023b8dc4b5a6c0d5229b4f5
Affected versions
v5.*
v5.11
v5.11-rc6
v5.11-rc7
v5.12
v5.12-rc1
v5.12-rc1-dontuse
v5.12-rc2
v5.12-rc3
v5.12-rc4
v5.12-rc5
v5.12-rc6
v5.12-rc7
v5.12-rc8
v5.13
v5.13-rc1
v5.13-rc2
v5.13-rc3
v5.13-rc4
v5.13-rc5
v5.13-rc6
v5.13-rc7
v5.14
v5.14-rc1
v5.14-rc2
v5.14-rc3
v5.14-rc4
v5.14-rc5
v5.14-rc6
v5.14-rc7
v5.15
v5.15-rc1
v5.15-rc2
v5.15-rc3
v5.15-rc4
v5.15-rc5
v5.15-rc6
v5.15-rc7
v5.15.1
v5.15.10
v5.15.11
v5.15.12
v5.15.13
v5.15.14
v5.15.15
v5.15.16
v5.15.17
v5.15.18
v5.15.19
v5.15.2
v5.15.20
v5.15.21
v5.15.22
v5.15.23
v5.15.24
v5.15.25
v5.15.26
v5.15.27
v5.15.28
v5.15.29
v5.15.3
v5.15.30
v5.15.31
v5.15.32
v5.15.33
v5.15.34
v5.15.35
v5.15.36
v5.15.37
v5.15.38
v5.15.39
v5.15.4
v5.15.40
v5.15.41
v5.15.42
v5.15.43
v5.15.44
v5.15.45
v5.15.46
v5.15.47
v5.15.48
v5.15.49
v5.15.5
v5.15.50
v5.15.51
v5.15.52
v5.15.53
v5.15.54
v5.15.55
v5.15.56
v5.15.57
v5.15.58
v5.15.59
v5.15.6
v5.15.60
v5.15.61
v5.15.62
v5.15.63
v5.15.64
v5.15.65
v5.15.66
v5.15.67
v5.15.68
v5.15.69
v5.15.7
v5.15.70
v5.15.71
v5.15.72
v5.15.73
v5.15.74
v5.15.75
v5.15.76
v5.15.77
v5.15.78
v5.15.79
v5.15.8
v5.15.80
v5.15.81
v5.15.82
v5.15.83
v5.15.84
v5.15.85
v5.15.86
v5.15.87
v5.15.88
v5.15.89
v5.15.9
v5.16
v5.16-rc1
v5.16-rc2
v5.16-rc3
v5.16-rc4
v5.16-rc5
v5.16-rc6
v5.16-rc7
v5.16-rc8
v5.17
v5.17-rc1
v5.17-rc2
v5.17-rc3
v5.17-rc4
v5.17-rc5
v5.17-rc6
v5.17-rc7
v5.17-rc8
v5.18
v5.18-rc1
v5.18-rc2
v5.18-rc3
v5.18-rc4
v5.18-rc5
v5.18-rc6
v5.18-rc7
v5.19
v5.19-rc1
v5.19-rc2
v5.19-rc3
v5.19-rc4
v5.19-rc5
v5.19-rc6
v5.19-rc7
v5.19-rc8
v6.*
v6.0
v6.0-rc1
v6.0-rc2
v6.0-rc3
v6.0-rc4
v6.0-rc5
v6.0-rc6
v6.0-rc7
v6.1
v6.1-rc1
v6.1-rc2
v6.1-rc3
v6.1-rc4
v6.1-rc5
v6.1-rc6
v6.1-rc7
v6.1-rc8
v6.1.1
v6.1.2
v6.1.3
v6.1.4
v6.1.5
v6.1.6
v6.1.7
v6.2-rc1
v6.2-rc2
v6.2-rc3
v6.2-rc4
Database specific
vanir_signatures
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5abbeebd8296c2301023b8dc4b5a6c0d5229b4f5",
"target": {
"file": "drivers/accessibility/speakup/spk_ttyio.c"
},
"deprecated": false,
"id": "CVE-2022-48870-190d591b",
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"44667930481586350597707408130324405533",
"323368231760875883006925320442666781621",
"226896962746905650409772620532239122171"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@64152e05a4de3ebf59f1740a0985a6d5fba0c77b",
"target": {
"file": "drivers/accessibility/speakup/spk_ttyio.c"
},
"deprecated": false,
"id": "CVE-2022-48870-56836428",
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"44667930481586350597707408130324405533",
"323368231760875883006925320442666781621",
"226896962746905650409772620532239122171"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@64152e05a4de3ebf59f1740a0985a6d5fba0c77b",
"target": {
"function": "spk_ttyio_release",
"file": "drivers/accessibility/speakup/spk_ttyio.c"
},
"deprecated": false,
"id": "CVE-2022-48870-b4d2d22d",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 227.0,
"function_hash": "61301491220673482849610547003934684553"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2da67bff29ab49caafb0766e8b8383b735ff796f",
"target": {
"file": "drivers/accessibility/speakup/spk_ttyio.c"
},
"deprecated": false,
"id": "CVE-2022-48870-b58b48a3",
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"44667930481586350597707408130324405533",
"323368231760875883006925320442666781621",
"226896962746905650409772620532239122171"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2da67bff29ab49caafb0766e8b8383b735ff796f",
"target": {
"function": "spk_ttyio_release",
"file": "drivers/accessibility/speakup/spk_ttyio.c"
},
"deprecated": false,
"id": "CVE-2022-48870-bd878e61",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 227.0,
"function_hash": "61301491220673482849610547003934684553"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5abbeebd8296c2301023b8dc4b5a6c0d5229b4f5",
"target": {
"function": "spk_ttyio_release",
"file": "drivers/accessibility/speakup/spk_ttyio.c"
},
"deprecated": false,
"id": "CVE-2022-48870-cb00ea56",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 227.0,
"function_hash": "61301491220673482849610547003934684553"
}
}
]