CVE-2022-48972 - mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add()

Back Back to CVE browser

MEDIUM

mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add()

Published Oct 21, 2024

5.5

MEDIUM

CVSS 3.1

EPSS 0.28%

Description

Kernel fault injection test reports null-ptr-deref as follows:

BUG: kernel NULL pointer dereference, address: 0000000000000008 RIP: 0010:cfg802154_netdev_notifier_call+0x120/0x310 include/linux/list.h:114 Call Trace: <TASK> raw_notifier_call_chain+0x6d/0xa0 kernel/notifier.c:87 call_netdevice_notifiers_info+0x6e/0xc0 net/core/dev.c:1944 unregister_netdevice_many_notify+0x60d/0xcb0 net/core/dev.c:1982 unregister_netdevice_queue+0x154/0x1a0 net/core/dev.c:10879 register_netdevice+0x9a8/0xb90 net/core/dev.c:10083 ieee802154_if_add+0x6ed/0x7e0 net/mac802154/iface.c:659 ieee802154_register_hw+0x29c/0x330 net/mac802154/main.c:229 mcr20a_probe+0xaaa/0xcb1 drivers/net/ieee802154/mcr20a.c:1316

ieee802154_if_add() allocates wpan_dev as netdev's private data, but not init the list in struct wpan_dev. cfg802154_netdev_notifier_call() manage the list when device register/unregister, and may lead to null-ptr-deref.

Use INIT_LIST_HEAD() on it to initialize it correctly.

Affected products

Vendor Linux Product Linux Default
unaffected
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
Vendor Linux Product Linux Default
affected
- Version
  3.19
  Status
  affected
  Constraints
  -
- Version
  0
  Status
  unaffected
  Constraints
  <3.19
- Version
  4.14.302
  Status
  unaffected
  Constraints
  <=4.14.*
- Version
  4.19.269
  Status
  unaffected
  Constraints
  <=4.19.*
- Version
  4.9.336
  Status
  unaffected
  Constraints
  <=4.9.*
- Version
  5.10.159
  Status
  unaffected
  Constraints
  <=5.10.*
- Version
  5.15.83
  Status
  unaffected
  Constraints
  <=5.15.*
- Version
  5.4.227
  Status
  unaffected
  Constraints
  <=5.4.*
- Version
  6.0.13
  Status
  unaffected
  Constraints
  <=6.0.*
- Version
  6.1
  Status
  unaffected
  Constraints
  <=*

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Linux

unaffected

Version	Status	Constraints
	affected
	affected
	affected
	affected
	affected
	affected
	affected
	affected

Linux

affected

Version	Status	Constraints
3.19	affected	-
0	unaffected	<3.19
4.14.302	unaffected	<=4.14.*
4.19.269	unaffected	<=4.19.*
4.9.336	unaffected	<=4.9.*
5.10.159	unaffected	<=5.10.*
5.15.83	unaffected	<=5.15.*
5.4.227	unaffected	<=5.4.*
6.0.13	unaffected	<=6.0.*
6.1	unaffected	<=*

Red Hat Enterprise Linux 6

kernel

Not affected
Red Hat Enterprise Linux 7

kernel

Out of support scope
Red Hat Enterprise Linux 7

kernel-rt

Out of support scope
Red Hat Enterprise Linux 8

kernel

Will not fix
Red Hat Enterprise Linux 8

kernel-rt

Will not fix
Red Hat Enterprise Linux 9

kernel

Will not fix
Red Hat Enterprise Linux 9

kernel-rt

Will not fix

Product	Package	State	Advisory
Red Hat Enterprise Linux 6	kernel	Not affected	n/a
Red Hat Enterprise Linux 7	kernel	Out of support scope	n/a
Red Hat Enterprise Linux 7	kernel-rt	Out of support scope	n/a
Red Hat Enterprise Linux 8	kernel	Will not fix	n/a
Red Hat Enterprise Linux 8	kernel-rt	Will not fix	n/a
Red Hat Enterprise Linux 9	kernel	Will not fix	n/a
Red Hat Enterprise Linux 9	kernel-rt	Will not fix	n/a

Remediation

Red Hat mitigation

If IEEE 802.15.4 wireless communication is not required, prevent the `mac802154` kernel module from loading by blacklisting it. To blacklist the module, create a file named `/etc/modprobe.d/blacklist-mac802154.conf` with the following content: ``` blacklist mac802154 ``` After creating the file, a system reboot or a reload of kernel modules is required for the change to take effect. This mitigation may impact functionality that relies on IEEE 802.15.4 devices.

Weaknesses (1)

CWE-476

NULL Pointer Dereference

References (13)

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2022-48972		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2320736		Issue Tracking
https://git.kernel.org/stable/c/1831d4540406708e48239cf38fd9c3b7ea98e08f		Patch
https://git.kernel.org/stable/c/42c319635c0cf7eb36eccac6cda76532f47b61a3		Patch
https://git.kernel.org/stable/c/623918f40fa68e3bb21312a3fafb90f491bf5358		Patch
https://git.kernel.org/stable/c/7410f4d1221bb182510b7778ab6eefa8b9b7102d		Patch
https://git.kernel.org/stable/c/9980a3ea20de40c83817877106c909cb032692d2		Patch
https://git.kernel.org/stable/c/a110287ef4a423980309490df632e1c1e73b3dc9		Patch
https://git.kernel.org/stable/c/b3d72d3135d2ef68296c1ee174436efd65386f04		Patch
https://git.kernel.org/stable/c/f00c84fb1635c27ba24ec5df65d5bd7d7dc00008		Patch
https://lore.kernel.org/linux-cve-announce/2024102145-CVE-2022-48972-4ccd@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2022-48972
https://www.cve.org/CVERecord?id=CVE-2022-48972