In the Linux kernel, the following vulnerability has been resolved:
tipc: move bc link creation back to tipcnodecreate
Shuang Li reported a NULL pointer dereference crash:
[] BUG: kernel NULL pointer dereference, address: 0000000000000068 [] RIP: 0010:tipclinkisup+0x5/0x10 [tipc] [] Call Trace: [] <IRQ> [] tipcbcastrcv+0xa2/0x190 [tipc] [] tipcnodebcrcv+0x8b/0x200 [tipc] [] tipcrcv+0x3af/0x5b0 [tipc] [] tipcudp_recv+0xc7/0x1e0 [tipc]
It was caused by the 'l' passed into tipcbcastrcv() is NULL. When it creates a node in tipcnodecheckdest(), after inserting the new node into hashtable in tipcnode_create(), it creates the bc link. However, there is a gap between this insert and bc link creation, a bc packet may come in and get the node from the hashtable then try to dereference its bc link, which is NULL.
This patch is to fix it by moving the bc link creation before inserting into the hashtable.
Note that for a preliminary node becoming "real", the bc link creation should also be called before it's rehashed, as we don't create it for preliminary nodes.
[
{
"id": "CVE-2022-49664-02f9d802",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cb8092d70a6f5f01ec1490fce4d35efed3ed996c",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"41364023376625852146087053063731242136",
"170950695615727317631370993145638047300",
"59056966180764556182277793738027927099",
"136508836680537974952122999541904091194",
"298527943562528099638706036954079885993",
"336884425506667426757387498433309689909",
"740669728309916021711223146585353764",
"278884048436443067824329760126907591303",
"168422598565518432541344827836517193988",
"298554867933102666608434935225874216303",
"279208636097742136447547409547507659546",
"106918404083570281121237666275027862651",
"234397825365605920695365445646860610937",
"314372908450970477339000796603446307687",
"284715764716090186471607864392972871165",
"246547334889631988214935131360715993881",
"273050021887994622693407658004309138491",
"136289044995913941993614235719362993419",
"200582807243966697089192998234973247409",
"304360875723919269437564953638992650488",
"113508738521456331796697284110690677512",
"96405644842695806241375643604272698276",
"178501616481678130972863301635555351614",
"212195633760017106097320745677325452712",
"62882978791714246803668108272964929462",
"223695305926103827999215606863124843848",
"180548143439715570977668480246593528452",
"111319905157015015078868545701503870753",
"224761681267291071780573791227546836136",
"309893897026329983403833586660929186239",
"155445364907071446670370492754159298420",
"254680146155167335100917698544585807403",
"310299404053548096735721716661159210601",
"9936655243350226633980830450553913263",
"324108837642104985381011996482598378501",
"113044625654918073413088173034672555391",
"134348517300679649078385803075577475668"
]
},
"deprecated": false,
"target": {
"file": "net/tipc/node.c"
}
},
{
"id": "CVE-2022-49664-0662fb20",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e52910e671f58c619e33dac476b11b35e2d3ab6f",
"signature_type": "Function",
"digest": {
"function_hash": "89001884854857490227859426780918784829",
"length": 2822.0
},
"deprecated": false,
"target": {
"function": "tipc_node_check_dest",
"file": "net/tipc/node.c"
}
},
{
"id": "CVE-2022-49664-33a4b305",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e52910e671f58c619e33dac476b11b35e2d3ab6f",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"41364023376625852146087053063731242136",
"170950695615727317631370993145638047300",
"59056966180764556182277793738027927099",
"136508836680537974952122999541904091194",
"298527943562528099638706036954079885993",
"336884425506667426757387498433309689909",
"740669728309916021711223146585353764",
"278884048436443067824329760126907591303",
"168422598565518432541344827836517193988",
"298554867933102666608434935225874216303",
"279208636097742136447547409547507659546",
"106918404083570281121237666275027862651",
"234397825365605920695365445646860610937",
"314372908450970477339000796603446307687",
"284715764716090186471607864392972871165",
"246547334889631988214935131360715993881",
"273050021887994622693407658004309138491",
"136289044995913941993614235719362993419",
"200582807243966697089192998234973247409",
"304360875723919269437564953638992650488",
"113508738521456331796697284110690677512",
"96405644842695806241375643604272698276",
"178501616481678130972863301635555351614",
"212195633760017106097320745677325452712",
"62882978791714246803668108272964929462",
"223695305926103827999215606863124843848",
"180548143439715570977668480246593528452",
"111319905157015015078868545701503870753",
"224761681267291071780573791227546836136",
"309893897026329983403833586660929186239",
"155445364907071446670370492754159298420",
"254680146155167335100917698544585807403",
"310299404053548096735721716661159210601",
"9936655243350226633980830450553913263",
"324108837642104985381011996482598378501",
"113044625654918073413088173034672555391",
"134348517300679649078385803075577475668"
]
},
"deprecated": false,
"target": {
"file": "net/tipc/node.c"
}
},
{
"id": "CVE-2022-49664-44d39b5c",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cb8092d70a6f5f01ec1490fce4d35efed3ed996c",
"signature_type": "Function",
"digest": {
"function_hash": "89001884854857490227859426780918784829",
"length": 2822.0
},
"deprecated": false,
"target": {
"function": "tipc_node_check_dest",
"file": "net/tipc/node.c"
}
},
{
"id": "CVE-2022-49664-5ed4b3e7",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e52910e671f58c619e33dac476b11b35e2d3ab6f",
"signature_type": "Function",
"digest": {
"function_hash": "88920254675223155922473892731819341578",
"length": 3355.0
},
"deprecated": false,
"target": {
"function": "tipc_node_create",
"file": "net/tipc/node.c"
}
},
{
"id": "CVE-2022-49664-6f10daf5",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@456bc338871c4a52117dd5ef29cce3745456d248",
"signature_type": "Function",
"digest": {
"function_hash": "88920254675223155922473892731819341578",
"length": 3355.0
},
"deprecated": false,
"target": {
"function": "tipc_node_create",
"file": "net/tipc/node.c"
}
},
{
"id": "CVE-2022-49664-793e2cd2",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@35fcb2ba35b4d9b592b558c3bcc6e0d90e213588",
"signature_type": "Function",
"digest": {
"function_hash": "89001884854857490227859426780918784829",
"length": 2822.0
},
"deprecated": false,
"target": {
"function": "tipc_node_check_dest",
"file": "net/tipc/node.c"
}
},
{
"id": "CVE-2022-49664-a65f4c33",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@456bc338871c4a52117dd5ef29cce3745456d248",
"signature_type": "Function",
"digest": {
"function_hash": "89001884854857490227859426780918784829",
"length": 2822.0
},
"deprecated": false,
"target": {
"function": "tipc_node_check_dest",
"file": "net/tipc/node.c"
}
},
{
"id": "CVE-2022-49664-aec3b5dc",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cb8092d70a6f5f01ec1490fce4d35efed3ed996c",
"signature_type": "Function",
"digest": {
"function_hash": "88920254675223155922473892731819341578",
"length": 3355.0
},
"deprecated": false,
"target": {
"function": "tipc_node_create",
"file": "net/tipc/node.c"
}
},
{
"id": "CVE-2022-49664-b94ad42e",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@35fcb2ba35b4d9b592b558c3bcc6e0d90e213588",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"41364023376625852146087053063731242136",
"170950695615727317631370993145638047300",
"59056966180764556182277793738027927099",
"136508836680537974952122999541904091194",
"298527943562528099638706036954079885993",
"336884425506667426757387498433309689909",
"740669728309916021711223146585353764",
"278884048436443067824329760126907591303",
"168422598565518432541344827836517193988",
"298554867933102666608434935225874216303",
"279208636097742136447547409547507659546",
"106918404083570281121237666275027862651",
"234397825365605920695365445646860610937",
"314372908450970477339000796603446307687",
"284715764716090186471607864392972871165",
"246547334889631988214935131360715993881",
"273050021887994622693407658004309138491",
"136289044995913941993614235719362993419",
"200582807243966697089192998234973247409",
"304360875723919269437564953638992650488",
"113508738521456331796697284110690677512",
"96405644842695806241375643604272698276",
"178501616481678130972863301635555351614",
"212195633760017106097320745677325452712",
"62882978791714246803668108272964929462",
"223695305926103827999215606863124843848",
"180548143439715570977668480246593528452",
"111319905157015015078868545701503870753",
"224761681267291071780573791227546836136",
"309893897026329983403833586660929186239",
"155445364907071446670370492754159298420",
"254680146155167335100917698544585807403",
"310299404053548096735721716661159210601",
"9936655243350226633980830450553913263",
"324108837642104985381011996482598378501",
"113044625654918073413088173034672555391",
"134348517300679649078385803075577475668"
]
},
"deprecated": false,
"target": {
"file": "net/tipc/node.c"
}
},
{
"id": "CVE-2022-49664-e24bd780",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@456bc338871c4a52117dd5ef29cce3745456d248",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"41364023376625852146087053063731242136",
"170950695615727317631370993145638047300",
"59056966180764556182277793738027927099",
"136508836680537974952122999541904091194",
"298527943562528099638706036954079885993",
"336884425506667426757387498433309689909",
"740669728309916021711223146585353764",
"278884048436443067824329760126907591303",
"168422598565518432541344827836517193988",
"298554867933102666608434935225874216303",
"279208636097742136447547409547507659546",
"106918404083570281121237666275027862651",
"234397825365605920695365445646860610937",
"314372908450970477339000796603446307687",
"284715764716090186471607864392972871165",
"246547334889631988214935131360715993881",
"273050021887994622693407658004309138491",
"136289044995913941993614235719362993419",
"200582807243966697089192998234973247409",
"304360875723919269437564953638992650488",
"113508738521456331796697284110690677512",
"96405644842695806241375643604272698276",
"178501616481678130972863301635555351614",
"212195633760017106097320745677325452712",
"62882978791714246803668108272964929462",
"223695305926103827999215606863124843848",
"180548143439715570977668480246593528452",
"111319905157015015078868545701503870753",
"224761681267291071780573791227546836136",
"309893897026329983403833586660929186239",
"155445364907071446670370492754159298420",
"254680146155167335100917698544585807403",
"310299404053548096735721716661159210601",
"9936655243350226633980830450553913263",
"324108837642104985381011996482598378501",
"113044625654918073413088173034672555391",
"134348517300679649078385803075577475668"
]
},
"deprecated": false,
"target": {
"file": "net/tipc/node.c"
}
},
{
"id": "CVE-2022-49664-e38cfc1b",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@35fcb2ba35b4d9b592b558c3bcc6e0d90e213588",
"signature_type": "Function",
"digest": {
"function_hash": "88920254675223155922473892731819341578",
"length": 3355.0
},
"deprecated": false,
"target": {
"function": "tipc_node_create",
"file": "net/tipc/node.c"
}
}
]