Lucene search

K
vulnrichmentLinuxVULNRICHMENT:CVE-2022-48908
HistoryAug 22, 2024 - 1:30 a.m.

CVE-2022-48908 net: arcnet: com20020: Fix null-ptr-deref in com20020pci_probe()

2024-08-2201:30:49
Linux
github.com
1
linux kernel
vulnerability resolved
net
arcnet
com20020
null-ptr-deref
com20020pci_probe

AI Score

6.8

Confidence

Low

EPSS

0

Percentile

5.1%

SSVC

Exploitation

none

Automatable

no

Technical Impact

partial

In the Linux kernel, the following vulnerability has been resolved:

net: arcnet: com20020: Fix null-ptr-deref in com20020pci_probe()

During driver initialization, the pointer of card info, i.e. the
variable ‘ci’ is required. However, the definition of
‘com20020pci_id_table’ reveals that this field is empty for some
devices, which will cause null pointer dereference when initializing
these devices.

The following log reveals it:

[ 3.973806] KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
[ 3.973819] RIP: 0010:com20020pci_probe+0x18d/0x13e0 [com20020_pci]
[ 3.975181] Call Trace:
[ 3.976208] local_pci_probe+0x13f/0x210
[ 3.977248] pci_device_probe+0x34c/0x6d0
[ 3.977255] ? pci_uevent+0x470/0x470
[ 3.978265] really_probe+0x24c/0x8d0
[ 3.978273] __driver_probe_device+0x1b3/0x280
[ 3.979288] driver_probe_device+0x50/0x370

Fix this by checking whether the ‘ci’ is a null pointer first.

AI Score

6.8

Confidence

Low

EPSS

0

Percentile

5.1%

SSVC

Exploitation

none

Automatable

no

Technical Impact

partial

Related for VULNRICHMENT:CVE-2022-48908