In the Linux kernel, the following vulnerability has been resolved:
block: don't delete queue kobject before its children
kobjects aren't supposed to be deleted before their child kobjects are deleted. Apparently this is usually benign; however, a WARN will be triggered if one of the child kobjects has a named attribute group:
sysfs group 'modes' not found for kobject 'crypto'
WARNING: CPU: 0 PID: 1 at fs/sysfs/group.c:278 sysfs_remove_group+0x72/0x80
...
Call Trace:
sysfs_remove_groups+0x29/0x40 fs/sysfs/group.c:312
__kobject_del+0x20/0x80 lib/kobject.c:611
kobject_cleanup+0xa4/0x140 lib/kobject.c:696
kobject_release lib/kobject.c:736 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0x53/0x70 lib/kobject.c:753
blk_crypto_sysfs_unregister+0x10/0x20 block/blk-crypto-sysfs.c:159
blk_unregister_queue+0xb0/0x110 block/blk-sysfs.c:962
del_gendisk+0x117/0x250 block/genhd.c:610
Fix this by moving the kobjectdel() and the corresponding kobjectuevent() to the correct place.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49259.json",
"cna_assigner": "Linux"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-49259.json"
[
{
"id": "CVE-2022-49259-21593440",
"digest": {
"line_hashes": [
"24198592950604978504679239553401895772",
"74409837946906845371158062088448466388",
"136836383636129179746724012810981898978",
"82132666179804281731737740103215619095",
"72021321008156569034563242616168249670",
"159046903302026207743099957830256271456",
"215868339991946233324089902286805128483",
"275998942913292863224440820727595761106",
"156912233604732173901895245683575228865"
],
"threshold": 0.9
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cf0cb8686e55d9c022944bc6ba9e19e832889e83",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "block/blk-sysfs.c"
}
},
{
"id": "CVE-2022-49259-99c40d68",
"digest": {
"function_hash": "168386411524904696372887832789591201883",
"length": 675.0
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cf0cb8686e55d9c022944bc6ba9e19e832889e83",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "block/blk-sysfs.c",
"function": "blk_unregister_queue"
}
},
{
"id": "CVE-2022-49259-cb63d488",
"digest": {
"line_hashes": [
"24198592950604978504679239553401895772",
"74409837946906845371158062088448466388",
"136836383636129179746724012810981898978",
"82132666179804281731737740103215619095",
"72021321008156569034563242616168249670",
"329301736535190226338992736714652071902",
"64547411446103771687398504275517241166",
"163051034341865803899186826906502084211",
"6944162636623421374442396313316564175",
"156912233604732173901895245683575228865"
],
"threshold": 0.9
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@84fe3ca6e7910beb47ec13509d484f84fa2a41ad",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "block/blk-sysfs.c"
}
},
{
"id": "CVE-2022-49259-e1c2b24b",
"digest": {
"function_hash": "262825622747360330050627351888160625381",
"length": 654.0
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@84fe3ca6e7910beb47ec13509d484f84fa2a41ad",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "block/blk-sysfs.c",
"function": "blk_unregister_queue"
}
}
]