CVE-2022-48807 ice: Fix KASAN error in LAG NETDEV_UNREGISTER handler
A memory corruption bug in the Linux kernel ice driver can cause a system crash when handling network device unregistration events.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-48807?
CVE-2022-48807 is a medium-severity memory corruption vulnerability in Linux kernel, published on 16 Jul 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ice: Fix KASAN error in LAG NETDEV_UNREGISTER handler
Currently, the same handler is called for both a NETDEV_BONDING_INFO LAG unlink notification as for a NETDEV_UNREGISTER call. This is causing a problem though, since the netdev_notifier_info passed has a different structure depending on which event is passed. The problem manifests as a call trace from a BUG: KASAN stack-out-of-bounds error.
Fix this by creating a handler specific to NETDEV_UNREGISTER that only is passed valid elements in the netdev_notifier_info struct for the NETDEV_UNREGISTER event.
Also included is the removal of an unbalanced dev_put on the peer_netdev and related braces.
Weakness: CWE-908
Which versions are affected by CVE-2022-48807?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2022-48807?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2022-48807 being exploited?
There is no known exploitation of CVE-2022-48807 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2022-48807, GHSA-69pm-pf6g-jvrq, UBUNTU-CVE-2022-48807.