PT-2024-10530 · Linux+3 · Linux Kernel+3
Published
2022-02-08
·
Updated
2025-01-20
·
CVE-2022-48817
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The issue is related to the incorrect handling of resource identifiers in the Linux kernel's net component, specifically in the DSA (Distributed Switch Architecture) driver for the ar9331 device. The
mdiobus free() function will panic when called from devm mdiobus free() due to the mdiobus not being previously unregistered. This issue applies when the DSA master is on a bus that calls ->remove from ->shutdown, such as the dpaa2-eth device on the fsl-mc bus. The same treatment must be applied to all DSA switch drivers, which is to either use devres for both the mdiobus allocation and registration or not use devres at all.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Linux Kernel
Red Os
Suse