Log in Start free

Vulnerability · Published Aug 22, 2024 · Assigned by Linux

CVE-2022-48908net: arcnet: com20020: Fix null-ptr-deref in com20020pci_probe()

Medium 5.5

In plain English

A medium-severity null pointer dereference in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.2%top 88.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: net: arcnet: com20020: Fix null-ptr-deref in com20020pci_probe() During driver initialization, the pointer of card info, i.e. the variable 'ci' is required. However, the definition of 'com20020pci_id_table' reveals that this field is empty for some devices, which will cause null pointer dereference when initializing these devices. The following log reveals it: [ 3.973806] KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] [ 3.973819] RIP: 0010:com20020pci_probe+0x18d/0x13e0 [com20020_pci] [ 3.975181] Call Trace: [ 3.976208] local_pci_probe+0x13f/0x210 [ 3.977248] pci_device_probe+0x34c/0x6d0 [ 3.977255] ? pci_uevent+0x470/0x470 [ 3.978265] really_probe+0x24c/0x8d0 [ 3.978273] __driver_probe_device+0x1b3/0x280 [ 3.979288] driver_probe_device+0x50/0x370 Fix this by checking whether the 'ci' is a null pointer first.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux5.16.14-1DEBIAN-CVE-2022-48908
Debian:13linux5.16.14-1DEBIAN-CVE-2022-48908
Debian:14linux5.16.14-1DEBIAN-CVE-2022-48908
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2022-48908
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2022-48908
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2022-48908
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2022-48908
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2022-48908
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2022-48908
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2022-48908
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2022-48908
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2022-48908
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2022-48908
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2022-48908
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2022-48908
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2022-48908
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2022-48908
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2022-48908
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2022-48908
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2022-48908
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2022-48908
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2022-48908
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2022-48908
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2022-48908
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2022-48908
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2022-48908
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2022-48908
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2022-48908
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2022-48908
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2022-48908
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2022-48908
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2022-48908
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2022-48908
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2022-48908
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2022-48908
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2022-48908

Affected products (as reported)

VendorProductVersions
Linux Linux 8c14f9c70327a6fb75534c4c61d7ea9c82ccf78f – before 8e3bc7c5bbf87e86e9cd652ca2a9166942d862068c14f9c70327a6fb75534c4c61d7ea9c82ccf78f – before b1ee6b9340a38bdb9e5c90f0eac5b22b122c30498c14f9c70327a6fb75534c4c61d7ea9c82ccf78f – before b838add93e1dd98210482dc433768daaf752bdef8c14f9c70327a6fb75534c4c61d7ea9c82ccf78f – before e50c589678e50f8d574612e473ca60ef451908968c14f9c70327a6fb75534c4c61d7ea9c82ccf78f – before 5f394102ee27dbf051a4e283390cd8d1759dacea8c14f9c70327a6fb75534c4c61d7ea9c82ccf78f – before ea372aab54903310756217d81610901a8e66cb7d8c14f9c70327a6fb75534c4c61d7ea9c82ccf78f – before ca0bdff4249a644f2ca7a49d410d95b8dacf1f728c14f9c70327a6fb75534c4c61d7ea9c82ccf78f – before bd6f1fd5d33dfe5d1b4f2502d3694a7cc13f166d
Linux Linux 3.18

Weakness: CWE-476 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References