In the Linux kernel, the following vulnerability has been resolved:
nvme-pci: fix a NULL pointer dereference in nvmeallocadmin_tags
In nvmeallocadmintags, the adminq can be set to an error (typically -ENOMEM) if the blkmqinitqueue call fails to set up the queue, which is checked immediately after the call. However, when we return the error message up the stack, to nvmeresetwork the error takes us to nvmeremovedeadctrl() nvmedevdisable() nvmesuspendqueue(&dev->queues[0]).
Here, we only check that the admin_q is non-NULL, rather than not an error or NULL, and begin quiescing a queue that never existed, leading to bad / NULL pointer dereference.
[
{
"id": "CVE-2022-49492-04242559",
"target": {
"function": "nvme_alloc_admin_tags",
"file": "drivers/nvme/host/pci.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@54a4c1e47d1b2585e74920399455bd9abbfb2bd7",
"digest": {
"length": 965.0,
"function_hash": "124622599650443597740767604162209121573"
},
"signature_type": "Function"
},
{
"id": "CVE-2022-49492-22706ac0",
"target": {
"function": "nvme_alloc_admin_tags",
"file": "drivers/nvme/host/pci.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8da2b7bdb47e94bbc4062a3978c708926bcb022c",
"digest": {
"length": 980.0,
"function_hash": "25346450322785238817305279737117182622"
},
"signature_type": "Function"
},
{
"id": "CVE-2022-49492-22bb37a9",
"target": {
"file": "drivers/nvme/host/pci.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@54a4c1e47d1b2585e74920399455bd9abbfb2bd7",
"digest": {
"line_hashes": [
"189340398057106018105639639272317455384",
"200726250506124752434064706230663124638",
"192045665729003607000691252727993974649",
"282736367606345628505427657099762287227"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2022-49492-2df0c29a",
"target": {
"function": "nvme_alloc_admin_tags",
"file": "drivers/nvme/host/pci.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7a28556082d1fbcbc599baf1c24252dfc73efefc",
"digest": {
"length": 965.0,
"function_hash": "124622599650443597740767604162209121573"
},
"signature_type": "Function"
},
{
"id": "CVE-2022-49492-35b6fcdc",
"target": {
"file": "drivers/nvme/host/pci.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da42761181627e9bdc37d18368b827948a583929",
"digest": {
"line_hashes": [
"189340398057106018105639639272317455384",
"200726250506124752434064706230663124638",
"192045665729003607000691252727993974649",
"282736367606345628505427657099762287227"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2022-49492-61662669",
"target": {
"file": "drivers/nvme/host/pci.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8321b17789f614414206af07e17ce4751c95dc76",
"digest": {
"line_hashes": [
"182958641058245049049949564226687177653",
"200726250506124752434064706230663124638",
"192045665729003607000691252727993974649",
"282736367606345628505427657099762287227"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2022-49492-66b5eb15",
"target": {
"function": "nvme_alloc_admin_tags",
"file": "drivers/nvme/host/pci.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8321b17789f614414206af07e17ce4751c95dc76",
"digest": {
"length": 873.0,
"function_hash": "226705691637100336100048583488064067233"
},
"signature_type": "Function"
},
{
"id": "CVE-2022-49492-71b315ea",
"target": {
"file": "drivers/nvme/host/pci.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8da2b7bdb47e94bbc4062a3978c708926bcb022c",
"digest": {
"line_hashes": [
"189340398057106018105639639272317455384",
"200726250506124752434064706230663124638",
"192045665729003607000691252727993974649",
"282736367606345628505427657099762287227"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2022-49492-7836046d",
"target": {
"function": "nvme_alloc_admin_tags",
"file": "drivers/nvme/host/pci.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@af98940dd33c9f9e1beb4f71c0a39260100e2a65",
"digest": {
"length": 968.0,
"function_hash": "96085488046562502551967025191104808987"
},
"signature_type": "Function"
},
{
"id": "CVE-2022-49492-81459715",
"target": {
"function": "nvme_alloc_admin_tags",
"file": "drivers/nvme/host/pci.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9e649471b396fa0139d53919354ce1eace9b9a24",
"digest": {
"length": 975.0,
"function_hash": "286868551623050754235498700173362047627"
},
"signature_type": "Function"
},
{
"id": "CVE-2022-49492-81c3e5c5",
"target": {
"file": "drivers/nvme/host/pci.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7a28556082d1fbcbc599baf1c24252dfc73efefc",
"digest": {
"line_hashes": [
"189340398057106018105639639272317455384",
"200726250506124752434064706230663124638",
"192045665729003607000691252727993974649",
"282736367606345628505427657099762287227"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2022-49492-82595489",
"target": {
"file": "drivers/nvme/host/pci.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@af98940dd33c9f9e1beb4f71c0a39260100e2a65",
"digest": {
"line_hashes": [
"189340398057106018105639639272317455384",
"200726250506124752434064706230663124638",
"192045665729003607000691252727993974649",
"282736367606345628505427657099762287227"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2022-49492-8b7bd210",
"target": {
"file": "drivers/nvme/host/pci.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f76729662650cd7bc8f8194e057af381370349a7",
"digest": {
"line_hashes": [
"189340398057106018105639639272317455384",
"200726250506124752434064706230663124638",
"192045665729003607000691252727993974649",
"282736367606345628505427657099762287227"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2022-49492-8dec31a9",
"target": {
"function": "nvme_alloc_admin_tags",
"file": "drivers/nvme/host/pci.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@906c81dba8ee8057523859b5e1a2479e9fd34860",
"digest": {
"length": 973.0,
"function_hash": "25518714805353055376246401122338927891"
},
"signature_type": "Function"
},
{
"id": "CVE-2022-49492-96fd1ba2",
"target": {
"file": "drivers/nvme/host/pci.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@906c81dba8ee8057523859b5e1a2479e9fd34860",
"digest": {
"line_hashes": [
"189340398057106018105639639272317455384",
"200726250506124752434064706230663124638",
"192045665729003607000691252727993974649",
"282736367606345628505427657099762287227"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2022-49492-b1c70f9b",
"target": {
"file": "drivers/nvme/host/pci.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9e649471b396fa0139d53919354ce1eace9b9a24",
"digest": {
"line_hashes": [
"189340398057106018105639639272317455384",
"200726250506124752434064706230663124638",
"192045665729003607000691252727993974649",
"282736367606345628505427657099762287227"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2022-49492-b753db49",
"target": {
"function": "nvme_alloc_admin_tags",
"file": "drivers/nvme/host/pci.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da42761181627e9bdc37d18368b827948a583929",
"digest": {
"length": 965.0,
"function_hash": "124622599650443597740767604162209121573"
},
"signature_type": "Function"
},
{
"id": "CVE-2022-49492-e10edaf1",
"target": {
"function": "nvme_alloc_admin_tags",
"file": "drivers/nvme/host/pci.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f76729662650cd7bc8f8194e057af381370349a7",
"digest": {
"length": 970.0,
"function_hash": "219960865406866679990901635584661465666"
},
"signature_type": "Function"
}
]