CVE-2022-48972
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2022-48972
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-48972.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2022-48972
- Downstream
- Related
- Published
- 2024-10-21T20:15:09Z
- Modified
- 2025-07-29T10:46:50.736554Z
- Severity
-
- 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
mac802154: fix missing INITLISTHEAD in ieee802154ifadd()
Kernel fault injection test reports null-ptr-deref as follows:
BUG: kernel NULL pointer dereference, address: 0000000000000008 RIP: 0010:cfg802154netdevnotifiercall+0x120/0x310 include/linux/list.h:114 Call Trace: <TASK> rawnotifiercallchain+0x6d/0xa0 kernel/notifier.c:87 callnetdevicenotifiersinfo+0x6e/0xc0 net/core/dev.c:1944 unregisternetdevicemanynotify+0x60d/0xcb0 net/core/dev.c:1982 unregisternetdevicequeue+0x154/0x1a0 net/core/dev.c:10879 registernetdevice+0x9a8/0xb90 net/core/dev.c:10083 ieee802154ifadd+0x6ed/0x7e0 net/mac802154/iface.c:659 ieee802154registerhw+0x29c/0x330 net/mac802154/main.c:229 mcr20aprobe+0xaaa/0xcb1 drivers/net/ieee802154/mcr20a.c:1316
ieee802154ifadd() allocates wpandev as netdev's private data, but not init the list in struct wpandev. cfg802154netdevnotifier_call() manage the list when device register/unregister, and may lead to null-ptr-deref.
Use INITLISTHEAD() on it to initialize it correctly.
- References
-
- https://git.kernel.org/stable/c/1831d4540406708e48239cf38fd9c3b7ea98e08f
- https://git.kernel.org/stable/c/42c319635c0cf7eb36eccac6cda76532f47b61a3
- https://git.kernel.org/stable/c/623918f40fa68e3bb21312a3fafb90f491bf5358
- https://git.kernel.org/stable/c/7410f4d1221bb182510b7778ab6eefa8b9b7102d
- https://git.kernel.org/stable/c/9980a3ea20de40c83817877106c909cb032692d2
- https://git.kernel.org/stable/c/a110287ef4a423980309490df632e1c1e73b3dc9
- https://git.kernel.org/stable/c/b3d72d3135d2ef68296c1ee174436efd65386f04
- https://git.kernel.org/stable/c/f00c84fb1635c27ba24ec5df65d5bd7d7dc00008
- https://security-tracker.debian.org/tracker/CVE-2022-48972
Affected packages
Debian:11 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed5.10.162-1
Affected versions
5.*
Debian:12 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source
Debian:13 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source