In the Linux kernel, the following vulnerability has been resolved:
mac802154: fix missing INITLISTHEAD in ieee802154ifadd()
Kernel fault injection test reports null-ptr-deref as follows:
BUG: kernel NULL pointer dereference, address: 0000000000000008 RIP: 0010:cfg802154netdevnotifiercall+0x120/0x310 include/linux/list.h:114 Call Trace: <TASK> rawnotifiercallchain+0x6d/0xa0 kernel/notifier.c:87 callnetdevicenotifiersinfo+0x6e/0xc0 net/core/dev.c:1944 unregisternetdevicemanynotify+0x60d/0xcb0 net/core/dev.c:1982 unregisternetdevicequeue+0x154/0x1a0 net/core/dev.c:10879 registernetdevice+0x9a8/0xb90 net/core/dev.c:10083 ieee802154ifadd+0x6ed/0x7e0 net/mac802154/iface.c:659 ieee802154registerhw+0x29c/0x330 net/mac802154/main.c:229 mcr20aprobe+0xaaa/0xcb1 drivers/net/ieee802154/mcr20a.c:1316
ieee802154ifadd() allocates wpandev as netdev's private data, but not init the list in struct wpandev. cfg802154netdevnotifier_call() manage the list when device register/unregister, and may lead to null-ptr-deref.
Use INITLISTHEAD() on it to initialize it correctly.
[
{
"id": "CVE-2022-48972-076db8af",
"target": {
"function": "ieee802154_if_add",
"file": "net/mac802154/iface.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7410f4d1221bb182510b7778ab6eefa8b9b7102d",
"digest": {
"length": 1511.0,
"function_hash": "138045196473915297019045847973944693737"
},
"signature_type": "Function"
},
{
"id": "CVE-2022-48972-11bbd376",
"target": {
"file": "net/mac802154/iface.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b3d72d3135d2ef68296c1ee174436efd65386f04",
"digest": {
"line_hashes": [
"32774217104211983525369166303862244955",
"44744112480164598661271555878185382357",
"17562472497132165710294917148455221791",
"45737297952849172053008651277717376637"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2022-48972-252ec4c5",
"target": {
"file": "net/mac802154/iface.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7410f4d1221bb182510b7778ab6eefa8b9b7102d",
"digest": {
"line_hashes": [
"32774217104211983525369166303862244955",
"44744112480164598661271555878185382357",
"17562472497132165710294917148455221791",
"45737297952849172053008651277717376637"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2022-48972-33407a75",
"target": {
"function": "ieee802154_if_add",
"file": "net/mac802154/iface.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b3d72d3135d2ef68296c1ee174436efd65386f04",
"digest": {
"length": 1523.0,
"function_hash": "297608381821441514434897916975459904620"
},
"signature_type": "Function"
},
{
"id": "CVE-2022-48972-75d33fe8",
"target": {
"function": "ieee802154_if_add",
"file": "net/mac802154/iface.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1831d4540406708e48239cf38fd9c3b7ea98e08f",
"digest": {
"length": 1511.0,
"function_hash": "138045196473915297019045847973944693737"
},
"signature_type": "Function"
},
{
"id": "CVE-2022-48972-b880f188",
"target": {
"file": "net/mac802154/iface.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f00c84fb1635c27ba24ec5df65d5bd7d7dc00008",
"digest": {
"line_hashes": [
"32774217104211983525369166303862244955",
"44744112480164598661271555878185382357",
"17562472497132165710294917148455221791",
"45737297952849172053008651277717376637"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2022-48972-bd8917a9",
"target": {
"function": "ieee802154_if_add",
"file": "net/mac802154/iface.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f00c84fb1635c27ba24ec5df65d5bd7d7dc00008",
"digest": {
"length": 1511.0,
"function_hash": "138045196473915297019045847973944693737"
},
"signature_type": "Function"
},
{
"id": "CVE-2022-48972-c4be56bb",
"target": {
"file": "net/mac802154/iface.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@623918f40fa68e3bb21312a3fafb90f491bf5358",
"digest": {
"line_hashes": [
"32774217104211983525369166303862244955",
"44744112480164598661271555878185382357",
"17562472497132165710294917148455221791",
"45737297952849172053008651277717376637"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2022-48972-ce4e3a58",
"target": {
"function": "ieee802154_if_add",
"file": "net/mac802154/iface.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@623918f40fa68e3bb21312a3fafb90f491bf5358",
"digest": {
"length": 1523.0,
"function_hash": "297608381821441514434897916975459904620"
},
"signature_type": "Function"
},
{
"id": "CVE-2022-48972-d6673356",
"target": {
"file": "net/mac802154/iface.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1831d4540406708e48239cf38fd9c3b7ea98e08f",
"digest": {
"line_hashes": [
"32774217104211983525369166303862244955",
"44744112480164598661271555878185382357",
"17562472497132165710294917148455221791",
"45737297952849172053008651277717376637"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2022-48972-ea769133",
"target": {
"file": "net/mac802154/iface.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@42c319635c0cf7eb36eccac6cda76532f47b61a3",
"digest": {
"line_hashes": [
"32774217104211983525369166303862244955",
"44744112480164598661271555878185382357",
"17562472497132165710294917148455221791",
"45737297952849172053008651277717376637"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2022-48972-f13584b5",
"target": {
"function": "ieee802154_if_add",
"file": "net/mac802154/iface.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@42c319635c0cf7eb36eccac6cda76532f47b61a3",
"digest": {
"length": 1511.0,
"function_hash": "138045196473915297019045847973944693737"
},
"signature_type": "Function"
}
]