CVE-2022-50282
Description
In the Linux kernel, the following vulnerability has been resolved: chardev: fix error handling in cdev_device_add() While doing fault injection test, I got the following report: ------------[ cut here ]------------ kobject: '(null)' (0000000039956980): is not initialized, yet kobject_put() is being called. WARNING: CPU: 3 PID: 6306 at kobject_put+0x23d/0x4e0 CPU: 3 PID: 6306 Comm: 283 Tainted: G W 6.1.0-rc2-00005-g307c1086d7c9 #1253 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 RIP: 0010:kobject_put+0x23d/0x4e0 Call Trace: <TASK> cdev_device_add+0x15e/0x1b0 __iio_device_register+0x13b4/0x1af0 [industrialio] __devm_iio_device_register+0x22/0x90 [industrialio] max517_probe+0x3d8/0x6b4 [max517] i2c_device_probe+0xa81/0xc00 When device_add() is injected fault and returns error, if dev->devt is not set, cdev_add() is not called, cdev_del() is not needed. Fix this by checking dev->devt in error path.
How to fix
- linux linux_kernel3.17, 4.5, 4.9.337, 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2 or later
- git.kernel.org/stable/c/11fa7fefe3d8fac7da56bc9aa3dd5fb3081ca797
- git.kernel.org/stable/c/28dc61cc49c6e995121c6d86bef4b73df78dda80
- git.kernel.org/stable/c/34d17b39bceef25e4cf9805cd59250ae05d0a139
- git.kernel.org/stable/c/5d2146889fad4cb9e6c13e790d4cfd871486eca8
- git.kernel.org/stable/c/6acf8597c5b04f455ee0649e11e5f3bcd28f381e
- git.kernel.org/stable/c/85a5660491b507d33662b8e81c142e6041e642eb
- git.kernel.org/stable/c/b5de1eac71fec1af7723f1083d23a24789fd795c
- git.kernel.org/stable/c/c46db6088bccff5115674d583fef46ede80077a2
- git.kernel.org/stable/c/d85b5247a79355b8432bfd9ac871f96117f750d4
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | 3.16.83 ≤ v < 3.17, 4.4.224 ≤ v < 4.5, 4.9.224 ≤ v < 4.9.337, 4.12 ≤ v < 4.14.303, 4.15 ≤ v < 4.19.270, 4.20 ≤ v < 5.4.229, 5.5 ≤ v < 5.10.163, 5.11 ≤ v < 5.15.86, 5.16 ≤ v < 6.0.16, 6.1 ≤ v < 6.1.2 | 3.17, 4.5, 4.9.337, 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.