In the Linux kernel, the following vulnerability has been resolved:
tty: ngsm: add sanity check for gsm->receive in gsmreceive_buf()
A null pointer dereference can happen when attempting to access the "gsm->receive()" function in gsmldreceivebuf(). Currently, the code assumes that gsm->recieve is only called after MUX activation. Since the gsmldreceivebuf() function can be accessed without the need to initialize the MUX, the gsm->receive() function will not be set and a NULL pointer dereference will occur.
Fix this by avoiding the call to "gsm->receive()" in case the function is not initialized by adding a sanity check.
Call Trace: <TASK> gsmldreceivebuf+0x1c2/0x2f0 drivers/tty/ngsm.c:2861 tiocsti drivers/tty/ttyio.c:2293 [inline] ttyioctl+0xa75/0x15d0 drivers/tty/ttyio.c:2692 vfsioctl fs/ioctl.c:51 [inline] _dosysioctl fs/ioctl.c:870 [inline] _sesysioctl fs/ioctl.c:856 [inline] _x64sysioctl+0x193/0x200 fs/ioctl.c:856 dosyscallx64 arch/x86/entry/common.c:50 [inline] dosyscall64+0x35/0xb0 arch/x86/entry/common.c:80 entrySYSCALL64afterhwframe+0x63/0xcd
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5aa37f9510345a812c0998bcbbc4d88d1dcc4d8b",
"target": {
"file": "drivers/tty/n_gsm.c"
},
"id": "CVE-2022-49940-04e3f09c",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"98870262531548946688386105962109052594",
"310916071957073776387690142563923523448",
"29241080137060372252245912531259754713",
"194371113336518818176372071816025948857"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@309aea4b6b813f6678c3a547cfd7fe3a76ffa976",
"target": {
"function": "gsmld_receive_buf",
"file": "drivers/tty/n_gsm.c"
},
"id": "CVE-2022-49940-24f4828d",
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "43008529942256453320561822793971950839",
"length": 583.0
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@309aea4b6b813f6678c3a547cfd7fe3a76ffa976",
"target": {
"file": "drivers/tty/n_gsm.c"
},
"id": "CVE-2022-49940-44077931",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"98870262531548946688386105962109052594",
"310916071957073776387690142563923523448",
"29241080137060372252245912531259754713",
"194371113336518818176372071816025948857"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f16c6d2e58a4c2b972efcf9eb12390ee0ba3befb",
"target": {
"function": "gsmld_receive_buf",
"file": "drivers/tty/n_gsm.c"
},
"id": "CVE-2022-49940-7bea927b",
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "331544550631997732447913150370537297675",
"length": 567.0
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5a82cf64f8ad63caf6bf115642ce44ddbc64311e",
"target": {
"file": "drivers/tty/n_gsm.c"
},
"id": "CVE-2022-49940-c166420c",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"98870262531548946688386105962109052594",
"310916071957073776387690142563923523448",
"29241080137060372252245912531259754713",
"194371113336518818176372071816025948857"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5aa37f9510345a812c0998bcbbc4d88d1dcc4d8b",
"target": {
"function": "gsmld_receive_buf",
"file": "drivers/tty/n_gsm.c"
},
"id": "CVE-2022-49940-d0d3bf29",
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "331544550631997732447913150370537297675",
"length": 567.0
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f16c6d2e58a4c2b972efcf9eb12390ee0ba3befb",
"target": {
"file": "drivers/tty/n_gsm.c"
},
"id": "CVE-2022-49940-d9bf52de",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"98870262531548946688386105962109052594",
"310916071957073776387690142563923523448",
"29241080137060372252245912531259754713",
"194371113336518818176372071816025948857"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5a82cf64f8ad63caf6bf115642ce44ddbc64311e",
"target": {
"function": "gsmld_receive_buf",
"file": "drivers/tty/n_gsm.c"
},
"id": "CVE-2022-49940-f74046b8",
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "154994973830390170969406302802021087388",
"length": 607.0
},
"signature_type": "Function"
}
]