PT-2022-7625 · Linux+3 · Linux Kernel+3

Marek Marczykowski-Górecki

·

Published

2022-02-25

·

Updated

2024-09-27

·

CVE-2022-48914

CVSS v3.1

5.5

Medium

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.16.10-1.32.fc32.qubes.x86 64+ #226
Description The vulnerability is related to the xen/netfront component of the Linux kernel. It occurs because xennet destroy queues() relies on info->netdev->real num tx queues to delete queues. However, since the update in the unregistration path, unregister netdev() indirectly sets real num tx queues to 0. As a result, xennet destroy queues() called from xennet remove() cannot perform its job because it is called after unregister netdev(). This leads to kfree-ing queues that are still linked in napi, causing a crash due to a kernel NULL pointer dereference.
Recommendations To resolve this issue, call xennet destroy queues() from xennet uninit() when real num tx queues is still available. This ensures that queues are destroyed when real num tx queues is set to 0, regardless of how unregister netdev() was called. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

NULL Pointer Dereference

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

BDU:2024-07469
CVE-2022-48914
OESA-2024-2122
OPENSUSE-SU-2024_3190-1
OPENSUSE-SU-2024_3209-1
OPENSUSE-SU-2024_3408-1
OPENSUSE-SU-2024_3483-1
SUSE-SU-2024:3190-1
SUSE-SU-2024:3209-1
SUSE-SU-2024:3227-1
SUSE-SU-2024:3408-1
SUSE-SU-2024:3483-1

Affected Products

Astra Linux
Linux Kernel
Red Os
Suse