In the Linux kernel, the following vulnerability has been resolved:
net, neigh: Fix null-ptr-deref in neightableclear()
When IPv6 module gets initialized but hits an error in the middle, kenel panic with:
KASAN: null-ptr-deref in range [0x0000000000000598-0x000000000000059f] CPU: 1 PID: 361 Comm: insmod Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) RIP: 0010:_neighifdown.isra.0+0x24b/0x370 RSP: 0018:ffff888012677908 EFLAGS: 00000202 ... Call Trace: <TASK> neightableclear+0x94/0x2d0 ndisccleanup+0x27/0x40 [ipv6] inet6init+0x21c/0x2cb [ipv6] dooneinitcall+0xd3/0x4d0 doinitmodule+0x1ae/0x670 ... Kernel panic - not syncing: Fatal exception
When ipv6 initialization fails, it will try to cleanup and calls:
neightableclear() neighifdown(tbl, NULL) pneighqueuepurge(&tbl->proxyqueue, devnet(dev == NULL)) # devnet(NULL) triggers null-ptr-deref.
Fix it by passing NULL to pneighqueuepurge() in neigh_ifdown() if dev is NULL, to make kernel not panic immediately.
[
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"303963258787133517550302561127229491529",
"116418839756175392823126104252209297863",
"295361560095894493698407088436060934790",
"117558884100556150981826793476775347859"
]
},
"target": {
"file": "net/core/neighbour.c"
},
"id": "CVE-2022-49904-0d2d93ae",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b736592de2aa53aee2d48d6b129bc0c892007bbe",
"signature_type": "Line"
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "324088057508210550137573604734817824950",
"length": 321.0
},
"target": {
"function": "__neigh_ifdown",
"file": "net/core/neighbour.c"
},
"id": "CVE-2022-49904-1886b2d6",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a99a8ec4c62180c889482a2ff6465033e0743458",
"signature_type": "Function"
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "324088057508210550137573604734817824950",
"length": 321.0
},
"target": {
"function": "__neigh_ifdown",
"file": "net/core/neighbour.c"
},
"id": "CVE-2022-49904-49e376c6",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2b45d6d0c41cb9593868e476681efb1aae5078a1",
"signature_type": "Function"
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"171154265315827695307774904286183201130",
"257248770299607418271337109079257067364",
"295361560095894493698407088436060934790",
"117558884100556150981826793476775347859"
]
},
"target": {
"file": "net/core/neighbour.c"
},
"id": "CVE-2022-49904-6d51c1a9",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1c89642e7f2b7ecc9635610653f5c2f0276c0051",
"signature_type": "Line"
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "324088057508210550137573604734817824950",
"length": 321.0
},
"target": {
"function": "__neigh_ifdown",
"file": "net/core/neighbour.c"
},
"id": "CVE-2022-49904-719c4f13",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b49f6b2f21f543d4dc88fb7b1ec2adccb822f27c",
"signature_type": "Function"
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "129441730594752006002774030483523838257",
"length": 292.0
},
"target": {
"function": "neigh_ifdown",
"file": "net/core/neighbour.c"
},
"id": "CVE-2022-49904-82b99e84",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0d38b4ca6679e72860ff8730e79bb99d0e9fa3b0",
"signature_type": "Function"
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "324088057508210550137573604734817824950",
"length": 321.0
},
"target": {
"function": "__neigh_ifdown",
"file": "net/core/neighbour.c"
},
"id": "CVE-2022-49904-adb7a4e7",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f8017317cb0b279b8ab98b0f3901a2e0ac880dad",
"signature_type": "Function"
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "324088057508210550137573604734817824950",
"length": 321.0
},
"target": {
"function": "__neigh_ifdown",
"file": "net/core/neighbour.c"
},
"id": "CVE-2022-49904-c9c5e4a2",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1c89642e7f2b7ecc9635610653f5c2f0276c0051",
"signature_type": "Function"
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "129441730594752006002774030483523838257",
"length": 292.0
},
"target": {
"function": "neigh_ifdown",
"file": "net/core/neighbour.c"
},
"id": "CVE-2022-49904-d831b73e",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b736592de2aa53aee2d48d6b129bc0c892007bbe",
"signature_type": "Function"
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"171154265315827695307774904286183201130",
"257248770299607418271337109079257067364",
"295361560095894493698407088436060934790",
"117558884100556150981826793476775347859"
]
},
"target": {
"file": "net/core/neighbour.c"
},
"id": "CVE-2022-49904-e919edce",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b49f6b2f21f543d4dc88fb7b1ec2adccb822f27c",
"signature_type": "Line"
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"303963258787133517550302561127229491529",
"116418839756175392823126104252209297863",
"295361560095894493698407088436060934790",
"117558884100556150981826793476775347859"
]
},
"target": {
"file": "net/core/neighbour.c"
},
"id": "CVE-2022-49904-eca65613",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0d38b4ca6679e72860ff8730e79bb99d0e9fa3b0",
"signature_type": "Line"
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"171154265315827695307774904286183201130",
"257248770299607418271337109079257067364",
"295361560095894493698407088436060934790",
"117558884100556150981826793476775347859"
]
},
"target": {
"file": "net/core/neighbour.c"
},
"id": "CVE-2022-49904-ecd644c3",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f8017317cb0b279b8ab98b0f3901a2e0ac880dad",
"signature_type": "Line"
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"171154265315827695307774904286183201130",
"257248770299607418271337109079257067364",
"295361560095894493698407088436060934790",
"117558884100556150981826793476775347859"
]
},
"target": {
"file": "net/core/neighbour.c"
},
"id": "CVE-2022-49904-f404de30",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a99a8ec4c62180c889482a2ff6465033e0743458",
"signature_type": "Line"
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"171154265315827695307774904286183201130",
"257248770299607418271337109079257067364",
"295361560095894493698407088436060934790",
"117558884100556150981826793476775347859"
]
},
"target": {
"file": "net/core/neighbour.c"
},
"id": "CVE-2022-49904-ff801426",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2b45d6d0c41cb9593868e476681efb1aae5078a1",
"signature_type": "Line"
}
]