In the Linux kernel, the following vulnerability has been resolved:
ath9k: fix use-after-free in ath9khifusbrxcb
Syzbot reported use-after-free Read in ath9khifusbrxcb() [0]. The problem was in incorrect htchandle->drvpriv initialization.
Probable call trace which can trigger use-after-free:
ath9khtcprobedevice() /* htchandle->drvpriv = priv; */ ath9khtcwaitfortarget() <--- Failed ieee80211free_hw() <--- priv pointer is freed
<IRQ> ... ath9khifusbrxcb() ath9khifusbrxstream() RXSTATINC() <--- htchandle->drvpriv access
In order to not add fancy protection for drvpriv we can move htchandle->drvpriv initialization at the end of the ath9khtcprobedevice() and add helper macro to make all _STAT_ macros NULL safe, since syzbot has reported related NULL deref in that macros [1]
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b66ebac40f64336ae2d053883bee85261060bd27",
"target": {
"function": "ath9k_htc_probe_device",
"file": "drivers/net/wireless/ath/ath9k/htc_drv_init.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-50179-0bfc14dc",
"signature_type": "Function",
"digest": {
"length": 819.0,
"function_hash": "70844176088759128985036874433919408829"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b66ebac40f64336ae2d053883bee85261060bd27",
"target": {
"file": "drivers/net/wireless/ath/ath9k/htc_drv_init.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-50179-0ee781bc",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"66042093933375130010251268914765922031",
"22408692052075333569966774240009476880",
"66241678621424397326800598171776873057",
"305313595490236061814663642711282064175",
"196210465590087299228937403401006438287",
"108487657494720727191540919310151458653",
"275435198852899113343913127399482735740"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0ac4827f78c7ffe8eef074bc010e7e34bc22f533",
"target": {
"function": "ath9k_htc_probe_device",
"file": "drivers/net/wireless/ath/ath9k/htc_drv_init.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-50179-13a14e56",
"signature_type": "Function",
"digest": {
"length": 819.0,
"function_hash": "70844176088759128985036874433919408829"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@03ca957c5f7b55660957eda20b5db4110319ac7a",
"target": {
"file": "drivers/net/wireless/ath/ath9k/htc_drv_init.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-50179-3ab3f1f4",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"66042093933375130010251268914765922031",
"22408692052075333569966774240009476880",
"66241678621424397326800598171776873057",
"305313595490236061814663642711282064175",
"196210465590087299228937403401006438287",
"108487657494720727191540919310151458653",
"275435198852899113343913127399482735740"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6b14ab47937ba441e75e8dbb9fbfc9c55efa41c6",
"target": {
"file": "drivers/net/wireless/ath/ath9k/htc_drv_init.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-50179-5b0803ea",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"66042093933375130010251268914765922031",
"22408692052075333569966774240009476880",
"66241678621424397326800598171776873057",
"305313595490236061814663642711282064175",
"196210465590087299228937403401006438287",
"108487657494720727191540919310151458653",
"275435198852899113343913127399482735740"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@62bc1ea5c7401d77eaf73d0c6a15f3d2e742856e",
"target": {
"file": "drivers/net/wireless/ath/ath9k/htc_drv_init.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-50179-75de2f17",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"66042093933375130010251268914765922031",
"22408692052075333569966774240009476880",
"66241678621424397326800598171776873057",
"305313595490236061814663642711282064175",
"196210465590087299228937403401006438287",
"108487657494720727191540919310151458653",
"275435198852899113343913127399482735740"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ab7a0ddf5f1cdec63cb21840369873806fc36d80",
"target": {
"file": "drivers/net/wireless/ath/ath9k/htc_drv_init.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-50179-7797769d",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"66042093933375130010251268914765922031",
"22408692052075333569966774240009476880",
"66241678621424397326800598171776873057",
"305313595490236061814663642711282064175",
"196210465590087299228937403401006438287",
"108487657494720727191540919310151458653",
"275435198852899113343913127399482735740"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ab7a0ddf5f1cdec63cb21840369873806fc36d80",
"target": {
"function": "ath9k_htc_probe_device",
"file": "drivers/net/wireless/ath/ath9k/htc_drv_init.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-50179-82edaba8",
"signature_type": "Function",
"digest": {
"length": 819.0,
"function_hash": "70844176088759128985036874433919408829"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0ac4827f78c7ffe8eef074bc010e7e34bc22f533",
"target": {
"file": "drivers/net/wireless/ath/ath9k/htc_drv_init.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-50179-861a8e72",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"66042093933375130010251268914765922031",
"22408692052075333569966774240009476880",
"66241678621424397326800598171776873057",
"305313595490236061814663642711282064175",
"196210465590087299228937403401006438287",
"108487657494720727191540919310151458653",
"275435198852899113343913127399482735740"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e9e21206b8ea62220b486310c61277e7ebfe7cec",
"target": {
"file": "drivers/net/wireless/ath/ath9k/htc_drv_init.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-50179-93f3a384",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"66042093933375130010251268914765922031",
"22408692052075333569966774240009476880",
"66241678621424397326800598171776873057",
"305313595490236061814663642711282064175",
"196210465590087299228937403401006438287",
"108487657494720727191540919310151458653",
"275435198852899113343913127399482735740"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eccd7c3e2596b574241a7670b5b53f5322f470e5",
"target": {
"file": "drivers/net/wireless/ath/ath9k/htc_drv_init.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-50179-9703297d",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"66042093933375130010251268914765922031",
"22408692052075333569966774240009476880",
"66241678621424397326800598171776873057",
"305313595490236061814663642711282064175",
"196210465590087299228937403401006438287",
"108487657494720727191540919310151458653",
"275435198852899113343913127399482735740"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@03ca957c5f7b55660957eda20b5db4110319ac7a",
"target": {
"function": "ath9k_htc_probe_device",
"file": "drivers/net/wireless/ath/ath9k/htc_drv_init.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-50179-d161ed95",
"signature_type": "Function",
"digest": {
"length": 819.0,
"function_hash": "70844176088759128985036874433919408829"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eccd7c3e2596b574241a7670b5b53f5322f470e5",
"target": {
"function": "ath9k_htc_probe_device",
"file": "drivers/net/wireless/ath/ath9k/htc_drv_init.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-50179-daf1b4bf",
"signature_type": "Function",
"digest": {
"length": 819.0,
"function_hash": "70844176088759128985036874433919408829"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6b14ab47937ba441e75e8dbb9fbfc9c55efa41c6",
"target": {
"function": "ath9k_htc_probe_device",
"file": "drivers/net/wireless/ath/ath9k/htc_drv_init.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-50179-db6e0589",
"signature_type": "Function",
"digest": {
"length": 819.0,
"function_hash": "70844176088759128985036874433919408829"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e9e21206b8ea62220b486310c61277e7ebfe7cec",
"target": {
"function": "ath9k_htc_probe_device",
"file": "drivers/net/wireless/ath/ath9k/htc_drv_init.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-50179-f07b234b",
"signature_type": "Function",
"digest": {
"length": 819.0,
"function_hash": "70844176088759128985036874433919408829"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@62bc1ea5c7401d77eaf73d0c6a15f3d2e742856e",
"target": {
"function": "ath9k_htc_probe_device",
"file": "drivers/net/wireless/ath/ath9k/htc_drv_init.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-50179-f95a1041",
"signature_type": "Function",
"digest": {
"length": 819.0,
"function_hash": "70844176088759128985036874433919408829"
}
}
]