CVE-2022-48908 net: arcnet: com20020: Fix null-ptr-deref in com20020pci_probe()
A null pointer dereference in the Linux kernel com20020 PCI driver can cause a system crash during device initialization.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-48908?
CVE-2022-48908 is a medium-severity vulnerability in Linux kernel, published on 22 Aug 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: arcnet: com20020: Fix null-ptr-deref in com20020pci_probe()
During driver initialization, the pointer of card info, i.e. the variable 'ci' is required. However, the definition of 'com20020pci_id_table' reveals that this field is empty for some devices, which will cause null pointer dereference when initializing these devices.
The following log reveals it:
[ 3.973806] KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] [ 3.973819] RIP: 0010:com20020pci_probe+0x18d/0x13e0 [com20020_pci] [ 3.975181] Call Trace: [ 3.976208] local_pci_probe+0x13f/0x210 [ 3.977248] pci_device_probe+0x34c/0x6d0 [ 3.977255] ? pci_uevent+0x470/0x470 [ 3.978265] really_probe+0x24c/0x8d0 [ 3.978273] __driver_probe_device+0x1b3/0x280 [ 3.979288] driver_probe_device+0x50/0x370
Fix this by checking whether the 'ci' is a null pointer first.
Weakness: CWE-476
Which versions are affected by CVE-2022-48908?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2022-48908?
Apply the vendor's patch.
Is CVE-2022-48908 being exploited?
There is no known exploitation of CVE-2022-48908 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2022-48908, GHSA-cp24-c7w4-6gh4, UBUNTU-CVE-2022-48908.