In the Linux kernel, the following vulnerability has been resolved:
hwmon: (ibmpex) Fix possible UAF when ibmpexregisterbmc() fails
Smatch report warning as follows:
drivers/hwmon/ibmpex.c:509 ibmpexregisterbmc() warn: '&data->list' not removed from list
If ibmpexfindsensors() fails in ibmpexregisterbmc(), data will be freed, but data->list will not be removed from driverdata.bmcdata, then list traversal may cause UAF.
Fix by removeing it from driverdata.bmcdata before free().
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49029.json"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-49029.json"
[
{
"signature_version": "v1",
"target": {
"file": "drivers/hwmon/ibmpex.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e65cfd1f9cd27d9c27ee5cb88128a9f79f25d863",
"deprecated": false,
"digest": {
"line_hashes": [
"281749271965227060535972145732450086628",
"282919481582442404649795333074680389001",
"167164877962528375993406512386629807357",
"155670715107179055012552341511185554558"
],
"threshold": 0.9
},
"id": "CVE-2022-49029-014a4fc2",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"file": "drivers/hwmon/ibmpex.c",
"function": "ibmpex_register_bmc"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e65cfd1f9cd27d9c27ee5cb88128a9f79f25d863",
"deprecated": false,
"digest": {
"function_hash": "191273625958169565234496615465203725713",
"length": 1394.0
},
"id": "CVE-2022-49029-58597f54",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "drivers/hwmon/ibmpex.c",
"function": "ibmpex_register_bmc"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90907cd4d11351ff76c9a447bcb5db0e264c47cd",
"deprecated": false,
"digest": {
"function_hash": "191273625958169565234496615465203725713",
"length": 1394.0
},
"id": "CVE-2022-49029-ccc5cad1",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "drivers/hwmon/ibmpex.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@45f6e81863747c0d7bc6a95ec51129900e71467a",
"deprecated": false,
"digest": {
"line_hashes": [
"281749271965227060535972145732450086628",
"282919481582442404649795333074680389001",
"167164877962528375993406512386629807357",
"155670715107179055012552341511185554558"
],
"threshold": 0.9
},
"id": "CVE-2022-49029-d01c3ee5",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"file": "drivers/hwmon/ibmpex.c",
"function": "ibmpex_register_bmc"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@45f6e81863747c0d7bc6a95ec51129900e71467a",
"deprecated": false,
"digest": {
"function_hash": "191273625958169565234496615465203725713",
"length": 1394.0
},
"id": "CVE-2022-49029-dc482976",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "drivers/hwmon/ibmpex.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90907cd4d11351ff76c9a447bcb5db0e264c47cd",
"deprecated": false,
"digest": {
"line_hashes": [
"281749271965227060535972145732450086628",
"282919481582442404649795333074680389001",
"167164877962528375993406512386629807357",
"155670715107179055012552341511185554558"
],
"threshold": 0.9
},
"id": "CVE-2022-49029-f3c1f32b",
"signature_type": "Line"
}
]