In the Linux kernel, the following vulnerability has been resolved:
gpio: Restrict usage of GPIO chip irq members before initialization
GPIO chip irq members are exposed before they could be completely initialized and this leads to race conditions.
One such issue was observed for the gc->irq.domain variable which was accessed through the I2C interface in gpiochiptoirq() before it could be initialized by gpiochipaddirqchip(). This resulted in Kernel NULL pointer dereference.
Following are the logs for reference :-
kernel: Call Trace: kernel: gpiodtoirq+0x53/0x70 kernel: acpidevgpioirqgetby+0x113/0x1f0 kernel: i2cacpigetirq+0xc0/0xd0 kernel: i2cdeviceprobe+0x28a/0x2a0 kernel: reallyprobe+0xf2/0x460 kernel: RIP: 0010:gpiochipto_irq+0x47/0xc0
To avoid such scenarios, restrict usage of GPIO chip irq members before they are completely initialized.
[
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/gpio/gpiolib.c",
"function": "gpiochip_add_irqchip"
},
"digest": {
"length": 1523.0,
"function_hash": "275397371342710173467639896768922729689"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f8dea54f74cae8c2e4d7b2952e8fed7743a85c87",
"signature_version": "v1",
"id": "CVE-2022-49072-04363864"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/gpio/gpiolib.c",
"function": "gpiochip_to_irq"
},
"digest": {
"length": 466.0,
"function_hash": "169334057005355801099682486204555112860"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5467801f1fcbdc46bc7298a84dbf3ca1ff2a7320",
"signature_version": "v1",
"id": "CVE-2022-49072-0986fd57"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/gpio/gpiolib.c",
"function": "gpiochip_to_irq"
},
"digest": {
"length": 466.0,
"function_hash": "169334057005355801099682486204555112860"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0912cf021fb5749372b3782611d8b1de4986c13a",
"signature_version": "v1",
"id": "CVE-2022-49072-0a5d153a"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/gpio/gpiolib.c",
"function": "gpiochip_add_irqchip"
},
"digest": {
"length": 1418.0,
"function_hash": "291877926924072867087823748478324345559"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0912cf021fb5749372b3782611d8b1de4986c13a",
"signature_version": "v1",
"id": "CVE-2022-49072-0dde5dd3"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/gpio/gpiolib.c"
},
"digest": {
"line_hashes": [
"69226276617033127176293013353373487180",
"219596279797701185248404740608858617188",
"155948315666646065168925873309382316179",
"295314264496834449670062887784711686018",
"12203466108723748168694694732719414002",
"166162907562917648369780790830028916889"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f8dea54f74cae8c2e4d7b2952e8fed7743a85c87",
"signature_version": "v1",
"id": "CVE-2022-49072-16af8556"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "include/linux/gpio/driver.h"
},
"digest": {
"line_hashes": [
"84819868236788387847936233238327619877",
"306896823311572677864626002816838975033",
"257796106328341810569325392459811838499"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5467801f1fcbdc46bc7298a84dbf3ca1ff2a7320",
"signature_version": "v1",
"id": "CVE-2022-49072-2f0dcef1"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/gpio/gpiolib.c"
},
"digest": {
"line_hashes": [
"69226276617033127176293013353373487180",
"219596279797701185248404740608858617188",
"155948315666646065168925873309382316179",
"295314264496834449670062887784711686018",
"12203466108723748168694694732719414002",
"166162907562917648369780790830028916889"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0912cf021fb5749372b3782611d8b1de4986c13a",
"signature_version": "v1",
"id": "CVE-2022-49072-3174f9bf"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/gpio/gpiolib.c",
"function": "gpiochip_add_irqchip"
},
"digest": {
"length": 1557.0,
"function_hash": "14655853370729325341320334752194968392"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7e88a50704b0c49ad3f2d11e8b963341cf68a89f",
"signature_version": "v1",
"id": "CVE-2022-49072-79dcb9e7"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "include/linux/gpio/driver.h"
},
"digest": {
"line_hashes": [
"84819868236788387847936233238327619877",
"306896823311572677864626002816838975033",
"257796106328341810569325392459811838499"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f8dea54f74cae8c2e4d7b2952e8fed7743a85c87",
"signature_version": "v1",
"id": "CVE-2022-49072-88520760"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "include/linux/gpio/driver.h"
},
"digest": {
"line_hashes": [
"120971620156648713683756821425764176319",
"216372715732173661665866286187966877557",
"154981826632782829121477900830031238640"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0912cf021fb5749372b3782611d8b1de4986c13a",
"signature_version": "v1",
"id": "CVE-2022-49072-930c775d"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "include/linux/gpio/driver.h"
},
"digest": {
"line_hashes": [
"120971620156648713683756821425764176319",
"216372715732173661665866286187966877557",
"154981826632782829121477900830031238640"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7e88a50704b0c49ad3f2d11e8b963341cf68a89f",
"signature_version": "v1",
"id": "CVE-2022-49072-99499b4c"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/gpio/gpiolib.c",
"function": "gpiochip_to_irq"
},
"digest": {
"length": 466.0,
"function_hash": "169334057005355801099682486204555112860"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c1fa3614795e2b24da1ba95de0b27b8f6ea4537",
"signature_version": "v1",
"id": "CVE-2022-49072-9dde2ecf"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/gpio/gpiolib.c"
},
"digest": {
"line_hashes": [
"69226276617033127176293013353373487180",
"219596279797701185248404740608858617188",
"155948315666646065168925873309382316179",
"295314264496834449670062887784711686018",
"12203466108723748168694694732719414002",
"166162907562917648369780790830028916889"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5467801f1fcbdc46bc7298a84dbf3ca1ff2a7320",
"signature_version": "v1",
"id": "CVE-2022-49072-b46db5d6"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/gpio/gpiolib.c"
},
"digest": {
"line_hashes": [
"69226276617033127176293013353373487180",
"219596279797701185248404740608858617188",
"155948315666646065168925873309382316179",
"295314264496834449670062887784711686018",
"12203466108723748168694694732719414002",
"166162907562917648369780790830028916889"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c1fa3614795e2b24da1ba95de0b27b8f6ea4537",
"signature_version": "v1",
"id": "CVE-2022-49072-c3ee82dd"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/gpio/gpiolib.c",
"function": "gpiochip_add_irqchip"
},
"digest": {
"length": 1523.0,
"function_hash": "275397371342710173467639896768922729689"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c1fa3614795e2b24da1ba95de0b27b8f6ea4537",
"signature_version": "v1",
"id": "CVE-2022-49072-ca07fee4"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/gpio/gpiolib.c",
"function": "gpiochip_add_irqchip"
},
"digest": {
"length": 1523.0,
"function_hash": "275397371342710173467639896768922729689"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5467801f1fcbdc46bc7298a84dbf3ca1ff2a7320",
"signature_version": "v1",
"id": "CVE-2022-49072-ce13b5e3"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/gpio/gpiolib.c",
"function": "gpiochip_to_irq"
},
"digest": {
"length": 466.0,
"function_hash": "169334057005355801099682486204555112860"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7e88a50704b0c49ad3f2d11e8b963341cf68a89f",
"signature_version": "v1",
"id": "CVE-2022-49072-d5a8d98b"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "include/linux/gpio/driver.h"
},
"digest": {
"line_hashes": [
"84819868236788387847936233238327619877",
"306896823311572677864626002816838975033",
"257796106328341810569325392459811838499"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c1fa3614795e2b24da1ba95de0b27b8f6ea4537",
"signature_version": "v1",
"id": "CVE-2022-49072-e7970250"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/gpio/gpiolib.c",
"function": "gpiochip_to_irq"
},
"digest": {
"length": 466.0,
"function_hash": "169334057005355801099682486204555112860"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f8dea54f74cae8c2e4d7b2952e8fed7743a85c87",
"signature_version": "v1",
"id": "CVE-2022-49072-ea6cb72b"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/gpio/gpiolib.c"
},
"digest": {
"line_hashes": [
"71337142194590634638079328719026276219",
"219596279797701185248404740608858617188",
"155948315666646065168925873309382316179",
"295314264496834449670062887784711686018",
"12203466108723748168694694732719414002",
"166162907562917648369780790830028916889"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7e88a50704b0c49ad3f2d11e8b963341cf68a89f",
"signature_version": "v1",
"id": "CVE-2022-49072-f9a92d51"
}
]