In the Linux kernel, the following vulnerability has been resolved:
ieee802154/adf7242: defer destroy_workqueue call
There is a possible race condition (use-after-free) like below
(FREE) | (USE) adf7242remove | adf7242channel canceldelayedworksync | destroyworkqueue (1) | adf7242cmdrx | moddelayedwork (2) |
The root cause for this race is that the upper layer (ieee802154) is unaware of this detaching event and the function adf7242_channel can be called without any checks.
To fix this, we can add a flag write at the beginning of adf7242remove and add flag check in adf7242channel. Or we can just defer the destructive operation like other commit 3e0588c291d6 ("hamradio: defer ax25 kfree after unregisternetdev") which let the ieee802154unregister_hw() to handle the synchronization. This patch takes the second option.
runs")
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9f8558c5c642c62c450c98c99b7d18a709fff485",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-49968-19183baa",
"target": {
"file": "drivers/net/ieee802154/adf7242.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"338783732185711888401424102590133074186",
"330734072138037513541793021999387422486",
"26485418197399017272364112014414994528",
"164793726237856589329414191998129109456",
"161857988365110921889976767709208605109",
"332492360545621604238504026095059141366"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@23a29932715ca43bceb2eae1bdb770995afe7271",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-49968-3b93bb06",
"target": {
"function": "adf7242_remove",
"file": "drivers/net/ieee802154/adf7242.c"
},
"digest": {
"length": 261.0,
"function_hash": "256297891904915909271322397863411340987"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9f8558c5c642c62c450c98c99b7d18a709fff485",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-49968-40633283",
"target": {
"function": "adf7242_remove",
"file": "drivers/net/ieee802154/adf7242.c"
},
"digest": {
"length": 261.0,
"function_hash": "256297891904915909271322397863411340987"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@15f3b89bd521d5770d36a61fc04a77c293138ba6",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-49968-66e06614",
"target": {
"file": "drivers/net/ieee802154/adf7242.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"338783732185711888401424102590133074186",
"330734072138037513541793021999387422486",
"26485418197399017272364112014414994528",
"164793726237856589329414191998129109456",
"161857988365110921889976767709208605109",
"299060580626938083728552464426520053295"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@afe7116f6d3b888778ed6d95e3cf724767b9aedf",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-49968-76fcaa09",
"target": {
"file": "drivers/net/ieee802154/adf7242.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"338783732185711888401424102590133074186",
"330734072138037513541793021999387422486",
"26485418197399017272364112014414994528",
"164793726237856589329414191998129109456",
"161857988365110921889976767709208605109",
"299060580626938083728552464426520053295"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@15f3b89bd521d5770d36a61fc04a77c293138ba6",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-49968-7bf128ed",
"target": {
"function": "adf7242_remove",
"file": "drivers/net/ieee802154/adf7242.c"
},
"digest": {
"length": 250.0,
"function_hash": "125133129291673890687450011781026520454"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bed12d7531df1417fc92c691999ff95e03835008",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-49968-8206fc53",
"target": {
"file": "drivers/net/ieee802154/adf7242.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"338783732185711888401424102590133074186",
"330734072138037513541793021999387422486",
"26485418197399017272364112014414994528",
"164793726237856589329414191998129109456",
"161857988365110921889976767709208605109",
"332492360545621604238504026095059141366"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bed12d7531df1417fc92c691999ff95e03835008",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-49968-90d71ef2",
"target": {
"function": "adf7242_remove",
"file": "drivers/net/ieee802154/adf7242.c"
},
"digest": {
"length": 261.0,
"function_hash": "256297891904915909271322397863411340987"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dede80aaf01f4b6e8657d23726cb4a3da226ec4c",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-49968-9c929130",
"target": {
"file": "drivers/net/ieee802154/adf7242.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"338783732185711888401424102590133074186",
"330734072138037513541793021999387422486",
"26485418197399017272364112014414994528",
"164793726237856589329414191998129109456",
"161857988365110921889976767709208605109",
"332492360545621604238504026095059141366"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@23a29932715ca43bceb2eae1bdb770995afe7271",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-49968-c8af4f33",
"target": {
"file": "drivers/net/ieee802154/adf7242.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"338783732185711888401424102590133074186",
"330734072138037513541793021999387422486",
"26485418197399017272364112014414994528",
"164793726237856589329414191998129109456",
"161857988365110921889976767709208605109",
"332492360545621604238504026095059141366"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dede80aaf01f4b6e8657d23726cb4a3da226ec4c",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-49968-f2cf378a",
"target": {
"function": "adf7242_remove",
"file": "drivers/net/ieee802154/adf7242.c"
},
"digest": {
"length": 261.0,
"function_hash": "256297891904915909271322397863411340987"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@afe7116f6d3b888778ed6d95e3cf724767b9aedf",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-49968-f504b6a6",
"target": {
"function": "adf7242_remove",
"file": "drivers/net/ieee802154/adf7242.c"
},
"digest": {
"length": 250.0,
"function_hash": "125133129291673890687450011781026520454"
},
"signature_type": "Function"
}
]