Skip to content
CVE PROGRAM SOURCE RECORD5.5 Medium

CVE-2022-49904

net, neigh: Fix null-ptr-deref in neigh_table_clear()

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: net, neigh: Fix null-ptr-deref in neigh_table_clear() When IPv6 module gets initialized but hits an error in the middle, kenel panic with: KASAN: null-ptr-deref in range [0x0000000000000598-0x000000000000059f] CPU: 1 PID: 361 Comm: insmod Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) RIP: 0010:__neigh_ifdown.isra.0+0x24b/0x370 RSP: 0018:ffff888012677908 EFLAGS: 00000202 ... Call Trace: <TASK> neigh_table_clear+0x94/0x2d0 ndisc_cleanup+0x27/0x40 [ipv6] inet6_init+0x21c/0x2cb [ipv6] do_one_initcall+0xd3/0x4d0 do_init_module+0x1ae/0x670 ... Kernel panic - not syncing: Fatal exception When ipv6 initialization fails, it will try to cleanup and calls: neigh_table_clear() neigh_ifdown(tbl, NULL) pneigh_queue_purge(&tbl->proxy_queue, dev_net(dev == NULL)) # dev_net(NULL) triggers null-ptr-deref. Fix it by passing NULL to pneigh_queue_purge() in neigh_ifdown() if dev is NULL, to make kernel not panic immediately.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 9bbaed571c4bf1b62ac8703cb359dc090efc3455 to < 0d38b4ca6679e72860ff8730e79bb99d0e9fa3b0affected
  • 05fdce1ae744dee43c9181fd063c9c0db4f777f2 to < b736592de2aa53aee2d48d6b129bc0c892007bbeaffected
  • 51be9dd391fd25872b95708a0250f2f7722d2d8e to < b49f6b2f21f543d4dc88fb7b1ec2adccb822f27caffected
  • c35adafe42bd6c3bf2aca0a3f523dabc38fc23c8 to < 1c89642e7f2b7ecc9635610653f5c2f0276c0051affected
  • db6fa03d80ab076238fc806c9925d1f8b9639d1b to < 2b45d6d0c41cb9593868e476681efb1aae5078a1affected
  • 66ba215cb51323e4e55e38fd5f250e0fae0cbc94 to < a99a8ec4c62180c889482a2ff6465033e0743458affected
  • 66ba215cb51323e4e55e38fd5f250e0fae0cbc94 to < f8017317cb0b279b8ab98b0f3901a2e0ac880dadaffected
  • 2dd5ed474115150d8175825bc3b56c6385c3a83baffected
  • 4.14.292 to < 4.14.299affected
  • 4.19.257 to < 4.19.265affected
  • 5.4.212 to < 5.4.224affected
  • 5.10.141 to < 5.10.154affected
  • 5.15.65 to < 5.15.78affected
  • 5.19.7 to < 5.20affected

Linux Linux

Default version status: affected

  • 6.0affected
  • 0 to < 6.0unaffected
  • 4.14.299 to ≤ 4.14.*unaffected
  • 4.19.265 to ≤ 4.19.*unaffected
  • 5.4.224 to ≤ 5.4.*unaffected
  • 5.10.154 to ≤ 5.10.*unaffected
  • 5.15.78 to ≤ 5.15.*unaffected
  • 6.0.8 to ≤ 6.0.*unaffected
  • 6.1 to ≤ *unaffected

References