In the Linux kernel, the following vulnerability has been resolved:
ftrace: Fix null pointer dereference in ftraceaddmod()
The @ftracemod is allocated by kzalloc(), so both the members {prev,next} of @ftracemode->list are NULL, it's not a valid state to call listdel(). If kstrdup() for @ftracemod->{func|module} fails, it goes to @outfree tag and calls freeftracemod() to destroy @ftracemod, then list_del() will write prev->next and next->prev, where null pointer dereference happens.
BUG: kernel NULL pointer dereference, address: 0000000000000008 Oops: 0002 [#1] PREEMPT SMP NOPTI Call Trace: <TASK> ftracemodcallback+0x20d/0x220 ? dofilpopen+0xd9/0x140 ftraceprocessregex.isra.51+0xbf/0x130 ftraceregexwrite.isra.52.part.53+0x6e/0x90 vfswrite+0xee/0x3a0 ? _auditfilterop+0xb1/0x100 ? auditdtesttask+0x38/0x50 ksyswrite+0xa5/0xe0 dosyscall64+0x3a/0x90 entrySYSCALL64after_hwframe+0x63/0xcd Kernel panic - not syncing: Fatal exception
So call INITLISTHEAD() to initialize the list member to fix this issue.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f715f31559b82e3f75ce047fa476de63d8107584",
"target": {
"file": "kernel/trace/ftrace.c"
},
"deprecated": false,
"id": "CVE-2022-49802-0d320e0d",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"227089864030653111852208929602649716868",
"268070911001527519891637050980000978969",
"164374086869093036135155047372713264396"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6a14828caddad0d989495a72af678adf60992704",
"target": {
"function": "ftrace_add_mod",
"file": "kernel/trace/ftrace.c"
},
"deprecated": false,
"id": "CVE-2022-49802-0d8e41d8",
"signature_version": "v1",
"digest": {
"length": 538.0,
"function_hash": "103203176055518155293047960089573530238"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6e50eb4b1807017f6c2d5089064256ce2de8aef1",
"target": {
"function": "ftrace_add_mod",
"file": "kernel/trace/ftrace.c"
},
"deprecated": false,
"id": "CVE-2022-49802-212c4e0e",
"signature_version": "v1",
"digest": {
"length": 538.0,
"function_hash": "103203176055518155293047960089573530238"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b5bfc61f541d3f092b13dedcfe000d86eb8e133c",
"target": {
"file": "kernel/trace/ftrace.c"
},
"deprecated": false,
"id": "CVE-2022-49802-2df0f268",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"227089864030653111852208929602649716868",
"268070911001527519891637050980000978969",
"164374086869093036135155047372713264396"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@665b4c6648bf2b91f69b33817f4321cf4c3cafe9",
"target": {
"function": "ftrace_add_mod",
"file": "kernel/trace/ftrace.c"
},
"deprecated": false,
"id": "CVE-2022-49802-2f59688a",
"signature_version": "v1",
"digest": {
"length": 538.0,
"function_hash": "103203176055518155293047960089573530238"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f715f31559b82e3f75ce047fa476de63d8107584",
"target": {
"function": "ftrace_add_mod",
"file": "kernel/trace/ftrace.c"
},
"deprecated": false,
"id": "CVE-2022-49802-55856209",
"signature_version": "v1",
"digest": {
"length": 538.0,
"function_hash": "103203176055518155293047960089573530238"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1bea037a1abb23a6729bef36a2265a4565f5ea77",
"target": {
"file": "kernel/trace/ftrace.c"
},
"deprecated": false,
"id": "CVE-2022-49802-5fe2fa4b",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"227089864030653111852208929602649716868",
"268070911001527519891637050980000978969",
"164374086869093036135155047372713264396"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6e50eb4b1807017f6c2d5089064256ce2de8aef1",
"target": {
"file": "kernel/trace/ftrace.c"
},
"deprecated": false,
"id": "CVE-2022-49802-7a3b503f",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"227089864030653111852208929602649716868",
"268070911001527519891637050980000978969",
"164374086869093036135155047372713264396"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1bea037a1abb23a6729bef36a2265a4565f5ea77",
"target": {
"function": "ftrace_add_mod",
"file": "kernel/trace/ftrace.c"
},
"deprecated": false,
"id": "CVE-2022-49802-9802b7e8",
"signature_version": "v1",
"digest": {
"length": 538.0,
"function_hash": "103203176055518155293047960089573530238"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@19ba6c8af9382c4c05dc6a0a79af3013b9a35cd0",
"target": {
"function": "ftrace_add_mod",
"file": "kernel/trace/ftrace.c"
},
"deprecated": false,
"id": "CVE-2022-49802-a3293b1c",
"signature_version": "v1",
"digest": {
"length": 538.0,
"function_hash": "103203176055518155293047960089573530238"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@665b4c6648bf2b91f69b33817f4321cf4c3cafe9",
"target": {
"file": "kernel/trace/ftrace.c"
},
"deprecated": false,
"id": "CVE-2022-49802-d77e9d30",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"227089864030653111852208929602649716868",
"268070911001527519891637050980000978969",
"164374086869093036135155047372713264396"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b5bfc61f541d3f092b13dedcfe000d86eb8e133c",
"target": {
"function": "ftrace_add_mod",
"file": "kernel/trace/ftrace.c"
},
"deprecated": false,
"id": "CVE-2022-49802-e3645495",
"signature_version": "v1",
"digest": {
"length": 538.0,
"function_hash": "103203176055518155293047960089573530238"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6a14828caddad0d989495a72af678adf60992704",
"target": {
"file": "kernel/trace/ftrace.c"
},
"deprecated": false,
"id": "CVE-2022-49802-ed25731a",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"227089864030653111852208929602649716868",
"268070911001527519891637050980000978969",
"164374086869093036135155047372713264396"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@19ba6c8af9382c4c05dc6a0a79af3013b9a35cd0",
"target": {
"file": "kernel/trace/ftrace.c"
},
"deprecated": false,
"id": "CVE-2022-49802-f69dd0fd",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"227089864030653111852208929602649716868",
"268070911001527519891637050980000978969",
"164374086869093036135155047372713264396"
]
},
"signature_type": "Line"
}
]