In the Linux kernel, the following vulnerability has been resolved:
nbd: call genlunregisterfamily() first in nbd_cleanup()
Otherwise there may be race between module removal and the handling of netlink command, which can lead to the oops as shown below:
BUG: kernel NULL pointer dereference, address: 0000000000000098 Oops: 0002 [#1] SMP PTI CPU: 1 PID: 31299 Comm: nbd-client Tainted: G E 5.14.0-rc4 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) RIP: 0010:downwrite+0x1a/0x50 Call Trace: startcreating+0x89/0x130 debugfscreatedir+0x1b/0x130 nbdstartdevice+0x13d/0x390 [nbd] nbdgenlconnect+0x42f/0x748 [nbd] genlfamilyrcvmsgdoit.isra.0+0xec/0x150 genlrcvmsg+0xe5/0x1e0 netlinkrcvskb+0x55/0x100 genlrcv+0x29/0x40 netlinkunicast+0x1a8/0x250 netlinksendmsg+0x21b/0x430 syssendmsg+0x2a4/0x2d0 syssendmsg+0x81/0xc0 _syssendmsg+0x62/0xb0 _x64syssendmsg+0x1f/0x30 dosyscall64+0x3b/0xc0 entrySYSCALL64after_hwframe+0x44/0xae Modules linked in: nbd(E-)
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c0868f6e728c3c28bef0e8bee89d2daf86a8bbca",
"id": "CVE-2022-49295-10c6be33",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/block/nbd.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"225677232941660980822517539348143764807",
"201167600557106808435563258995202125628",
"96631733576345794453511571534212646515",
"217630551754256544755607678314385805184",
"244838686788844698455455111553240195747",
"74128651099585348592239450613542217257",
"296108358014183913722673289389961525119"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@013a79f1b5c89290e2e97f1ebf14b14e0cf5fe5c",
"id": "CVE-2022-49295-144c05ff",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "nbd_cleanup",
"file": "drivers/block/nbd.c"
},
"digest": {
"length": 550.0,
"function_hash": "43897498517079437292630243604512712553"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8a1435c862ea09b06be7acda325128dc08458e25",
"id": "CVE-2022-49295-2fa35dcb",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/block/nbd.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"225677232941660980822517539348143764807",
"201167600557106808435563258995202125628",
"96631733576345794453511571534212646515",
"217630551754256544755607678314385805184",
"244838686788844698455455111553240195747",
"74128651099585348592239450613542217257",
"296108358014183913722673289389961525119"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8a1435c862ea09b06be7acda325128dc08458e25",
"id": "CVE-2022-49295-43b3bf98",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "nbd_cleanup",
"file": "drivers/block/nbd.c"
},
"digest": {
"length": 550.0,
"function_hash": "43897498517079437292630243604512712553"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cbeafa7a79d08ecdb55f8f1d41a11323d0f709db",
"id": "CVE-2022-49295-4d44b008",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "nbd_cleanup",
"file": "drivers/block/nbd.c"
},
"digest": {
"length": 576.0,
"function_hash": "80770682560007925208070377002803409751"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@06c4da89c24e7023ea448cadf8e9daf06a0aae6e",
"id": "CVE-2022-49295-5382165e",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "nbd_cleanup",
"file": "drivers/block/nbd.c"
},
"digest": {
"length": 576.0,
"function_hash": "80770682560007925208070377002803409751"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@013a79f1b5c89290e2e97f1ebf14b14e0cf5fe5c",
"id": "CVE-2022-49295-5582ce27",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/block/nbd.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"225677232941660980822517539348143764807",
"201167600557106808435563258995202125628",
"96631733576345794453511571534212646515",
"217630551754256544755607678314385805184",
"244838686788844698455455111553240195747",
"74128651099585348592239450613542217257",
"296108358014183913722673289389961525119"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1be608e1ee1f222464b2856bda9b85ab5184a33e",
"id": "CVE-2022-49295-5d196d83",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/block/nbd.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"225677232941660980822517539348143764807",
"201167600557106808435563258995202125628",
"96631733576345794453511571534212646515",
"217630551754256544755607678314385805184",
"244838686788844698455455111553240195747",
"74128651099585348592239450613542217257",
"296108358014183913722673289389961525119"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6f505bbb8063fd3a238a4239d2d8c165e5279f6f",
"id": "CVE-2022-49295-712745bc",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "nbd_cleanup",
"file": "drivers/block/nbd.c"
},
"digest": {
"length": 576.0,
"function_hash": "80770682560007925208070377002803409751"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6f505bbb8063fd3a238a4239d2d8c165e5279f6f",
"id": "CVE-2022-49295-7b440414",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/block/nbd.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"225677232941660980822517539348143764807",
"201167600557106808435563258995202125628",
"96631733576345794453511571534212646515",
"326120867377979100264997854875721158126",
"78794029335660530400339129900808196758",
"74128651099585348592239450613542217257",
"296108358014183913722673289389961525119"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3d5da1ffba3388c2ae2e6c598855a4d887d3bf79",
"id": "CVE-2022-49295-81a548f1",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/block/nbd.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"225677232941660980822517539348143764807",
"201167600557106808435563258995202125628",
"96631733576345794453511571534212646515",
"326120867377979100264997854875721158126",
"78794029335660530400339129900808196758",
"74128651099585348592239450613542217257",
"296108358014183913722673289389961525119"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3d5da1ffba3388c2ae2e6c598855a4d887d3bf79",
"id": "CVE-2022-49295-8f9254db",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "nbd_cleanup",
"file": "drivers/block/nbd.c"
},
"digest": {
"length": 576.0,
"function_hash": "80770682560007925208070377002803409751"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@06c4da89c24e7023ea448cadf8e9daf06a0aae6e",
"id": "CVE-2022-49295-d82b60a1",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/block/nbd.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"225677232941660980822517539348143764807",
"201167600557106808435563258995202125628",
"96631733576345794453511571534212646515",
"326120867377979100264997854875721158126",
"78794029335660530400339129900808196758",
"74128651099585348592239450613542217257",
"296108358014183913722673289389961525119"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c0868f6e728c3c28bef0e8bee89d2daf86a8bbca",
"id": "CVE-2022-49295-d98ce376",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "nbd_cleanup",
"file": "drivers/block/nbd.c"
},
"digest": {
"length": 550.0,
"function_hash": "43897498517079437292630243604512712553"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1be608e1ee1f222464b2856bda9b85ab5184a33e",
"id": "CVE-2022-49295-eccd75da",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "nbd_cleanup",
"file": "drivers/block/nbd.c"
},
"digest": {
"length": 550.0,
"function_hash": "43897498517079437292630243604512712553"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cbeafa7a79d08ecdb55f8f1d41a11323d0f709db",
"id": "CVE-2022-49295-f301e48f",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/block/nbd.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"225677232941660980822517539348143764807",
"201167600557106808435563258995202125628",
"96631733576345794453511571534212646515",
"326120867377979100264997854875721158126",
"78794029335660530400339129900808196758",
"74128651099585348592239450613542217257",
"296108358014183913722673289389961525119"
]
},
"signature_type": "Line"
}
]