In the Linux kernel, the following vulnerability has been resolved:
net: ieee802154: at86rf230: Stop leaking skb's
Upon error the ieee802154xmitcomplete() helper is not called. Only ieee802154wakequeue() is called manually. In the Tx case we then leak the skb structure.
Free the skb structure upon error before returning when appropriate.
As the 'istx = 0' cannot be moved in the complete handler because of a possible race between the delay in switching to STATERXAACKON and a new interrupt, we introduce an intermediate 'was_tx' boolean just for this purpose.
There is no Fixes tag applying here, many changes have been made on this area and the issue kind of always existed.
{ "vanir_signatures": [ { "signature_version": "v1", "digest": { "length": 155.0, "function_hash": "293252648226422890449528469540019298862" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@23b2a25382400168427ea278f3d8bf4ecfd333bf", "deprecated": false, "target": { "file": "drivers/net/ieee802154/at86rf230.c", "function": "at86rf230_async_error_recover_complete" }, "signature_type": "Function", "id": "CVE-2022-48794-01638361" }, { "signature_version": "v1", "digest": { "length": 196.0, "function_hash": "205166416311468152486414313041101177425" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1c72f04d52b7200bb83426a9bed378668271ea4a", "deprecated": false, "target": { "file": "drivers/net/ieee802154/at86rf230.c", "function": "at86rf230_async_error_recover" }, "signature_type": "Function", "id": "CVE-2022-48794-04d05695" }, { "signature_version": "v1", "digest": { "length": 155.0, "function_hash": "293252648226422890449528469540019298862" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@455ef08d6e5473526fa6763f75a93f7198206966", "deprecated": false, "target": { "file": "drivers/net/ieee802154/at86rf230.c", "function": "at86rf230_async_error_recover_complete" }, "signature_type": "Function", "id": "CVE-2022-48794-0eda69ae" }, { "signature_version": "v1", "digest": { "length": 155.0, "function_hash": "293252648226422890449528469540019298862" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6312f6a53fd3ea38125dcaca5e3c9aa7d8a60cf7", "deprecated": false, "target": { "file": "drivers/net/ieee802154/at86rf230.c", "function": "at86rf230_async_error_recover_complete" }, "signature_type": "Function", "id": "CVE-2022-48794-150b4400" }, { "signature_version": "v1", "digest": { "length": 155.0, "function_hash": "293252648226422890449528469540019298862" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@af649e5c95f56df64363bc46f6746b87819f9c0d", "deprecated": false, "target": { "file": "drivers/net/ieee802154/at86rf230.c", "function": "at86rf230_async_error_recover_complete" }, "signature_type": "Function", "id": "CVE-2022-48794-1acf326b" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "207722970236551356475970694708376684564", "7670740649353780980331970739719816673", "59847836328113329851006209570737859275", "203993903396593103037282141831791592213", "97995006831151487182330397022618792276", "3957477968341771052631696777592797300", "255168072077063357165181720630417078083", "248748527251715448121122931650098646170", "278449685286523123134278153224963924984", "123976451317791732623870474327914861332", "186468104317045269724397250198839496898", "293217027885710914558056515617620896992" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1c72f04d52b7200bb83426a9bed378668271ea4a", "deprecated": false, "target": { "file": "drivers/net/ieee802154/at86rf230.c" }, "signature_type": "Line", "id": "CVE-2022-48794-2882f050" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "207722970236551356475970694708376684564", "7670740649353780980331970739719816673", "59847836328113329851006209570737859275", "203993903396593103037282141831791592213", "97995006831151487182330397022618792276", "3957477968341771052631696777592797300", "255168072077063357165181720630417078083", "248748527251715448121122931650098646170", "278449685286523123134278153224963924984", "123976451317791732623870474327914861332", "186468104317045269724397250198839496898", "293217027885710914558056515617620896992" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e5ce576d45bf72fd0e3dc37eff897bfcc488f6a9", "deprecated": false, "target": { "file": "drivers/net/ieee802154/at86rf230.c" }, "signature_type": "Line", "id": "CVE-2022-48794-39befacf" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "207722970236551356475970694708376684564", "7670740649353780980331970739719816673", "59847836328113329851006209570737859275", "203993903396593103037282141831791592213", "97995006831151487182330397022618792276", "3957477968341771052631696777592797300", "255168072077063357165181720630417078083", "248748527251715448121122931650098646170", "278449685286523123134278153224963924984", "123976451317791732623870474327914861332", "186468104317045269724397250198839496898", "293217027885710914558056515617620896992" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@455ef08d6e5473526fa6763f75a93f7198206966", "deprecated": false, "target": { "file": "drivers/net/ieee802154/at86rf230.c" }, "signature_type": "Line", "id": "CVE-2022-48794-4353c853" }, { "signature_version": "v1", "digest": { "length": 196.0, "function_hash": "205166416311468152486414313041101177425" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0fd484644c68897c490a3307bfcc8bf767df5a43", "deprecated": false, "target": { "file": "drivers/net/ieee802154/at86rf230.c", "function": "at86rf230_async_error_recover" }, "signature_type": "Function", "id": "CVE-2022-48794-4e74eba7" }, { "signature_version": "v1", "digest": { "length": 155.0, "function_hash": "293252648226422890449528469540019298862" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1c72f04d52b7200bb83426a9bed378668271ea4a", "deprecated": false, "target": { "file": "drivers/net/ieee802154/at86rf230.c", "function": "at86rf230_async_error_recover_complete" }, "signature_type": "Function", "id": "CVE-2022-48794-57b4fbe6" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "207722970236551356475970694708376684564", "7670740649353780980331970739719816673", "59847836328113329851006209570737859275", "203993903396593103037282141831791592213", "97995006831151487182330397022618792276", "3957477968341771052631696777592797300", "255168072077063357165181720630417078083", "248748527251715448121122931650098646170", "278449685286523123134278153224963924984", "123976451317791732623870474327914861332", "186468104317045269724397250198839496898", "293217027885710914558056515617620896992" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d2a1eaf51b7d4412319adb6acef114ba472d1692", "deprecated": false, "target": { "file": "drivers/net/ieee802154/at86rf230.c" }, "signature_type": "Line", "id": "CVE-2022-48794-62f83126" }, { "signature_version": "v1", "digest": { "length": 196.0, "function_hash": "205166416311468152486414313041101177425" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@af649e5c95f56df64363bc46f6746b87819f9c0d", "deprecated": false, "target": { "file": "drivers/net/ieee802154/at86rf230.c", "function": "at86rf230_async_error_recover" }, "signature_type": "Function", "id": "CVE-2022-48794-71102c1e" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "207722970236551356475970694708376684564", "7670740649353780980331970739719816673", "59847836328113329851006209570737859275", "203993903396593103037282141831791592213", "97995006831151487182330397022618792276", "3957477968341771052631696777592797300", "255168072077063357165181720630417078083", "248748527251715448121122931650098646170", "278449685286523123134278153224963924984", "123976451317791732623870474327914861332", "186468104317045269724397250198839496898", "293217027885710914558056515617620896992" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@af649e5c95f56df64363bc46f6746b87819f9c0d", "deprecated": false, "target": { "file": "drivers/net/ieee802154/at86rf230.c" }, "signature_type": "Line", "id": "CVE-2022-48794-7f557787" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "207722970236551356475970694708376684564", "7670740649353780980331970739719816673", "59847836328113329851006209570737859275", "203993903396593103037282141831791592213", "97995006831151487182330397022618792276", "3957477968341771052631696777592797300", "255168072077063357165181720630417078083", "248748527251715448121122931650098646170", "278449685286523123134278153224963924984", "123976451317791732623870474327914861332", "186468104317045269724397250198839496898", "293217027885710914558056515617620896992" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0fd484644c68897c490a3307bfcc8bf767df5a43", "deprecated": false, "target": { "file": "drivers/net/ieee802154/at86rf230.c" }, "signature_type": "Line", "id": "CVE-2022-48794-9e7f9348" }, { "signature_version": "v1", "digest": { "length": 196.0, "function_hash": "205166416311468152486414313041101177425" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e5ce576d45bf72fd0e3dc37eff897bfcc488f6a9", "deprecated": false, "target": { "file": "drivers/net/ieee802154/at86rf230.c", "function": "at86rf230_async_error_recover" }, "signature_type": "Function", "id": "CVE-2022-48794-a285a7cd" }, { "signature_version": "v1", "digest": { "length": 155.0, "function_hash": "293252648226422890449528469540019298862" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d2a1eaf51b7d4412319adb6acef114ba472d1692", "deprecated": false, "target": { "file": "drivers/net/ieee802154/at86rf230.c", "function": "at86rf230_async_error_recover_complete" }, "signature_type": "Function", "id": "CVE-2022-48794-c4d93c09" }, { "signature_version": "v1", "digest": { "length": 196.0, "function_hash": "205166416311468152486414313041101177425" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6312f6a53fd3ea38125dcaca5e3c9aa7d8a60cf7", "deprecated": false, "target": { "file": "drivers/net/ieee802154/at86rf230.c", "function": "at86rf230_async_error_recover" }, "signature_type": "Function", "id": "CVE-2022-48794-c82b29c6" }, { "signature_version": "v1", "digest": { "length": 155.0, "function_hash": "293252648226422890449528469540019298862" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0fd484644c68897c490a3307bfcc8bf767df5a43", "deprecated": false, "target": { "file": "drivers/net/ieee802154/at86rf230.c", "function": "at86rf230_async_error_recover_complete" }, "signature_type": "Function", "id": "CVE-2022-48794-d5543b7f" }, { "signature_version": "v1", "digest": { "length": 155.0, "function_hash": "293252648226422890449528469540019298862" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e5ce576d45bf72fd0e3dc37eff897bfcc488f6a9", "deprecated": false, "target": { "file": "drivers/net/ieee802154/at86rf230.c", "function": "at86rf230_async_error_recover_complete" }, "signature_type": "Function", "id": "CVE-2022-48794-e4b4d95f" }, { "signature_version": "v1", "digest": { "length": 196.0, "function_hash": "205166416311468152486414313041101177425" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d2a1eaf51b7d4412319adb6acef114ba472d1692", "deprecated": false, "target": { "file": "drivers/net/ieee802154/at86rf230.c", "function": "at86rf230_async_error_recover" }, "signature_type": "Function", "id": "CVE-2022-48794-ea26ef55" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "207722970236551356475970694708376684564", "7670740649353780980331970739719816673", "59847836328113329851006209570737859275", "203993903396593103037282141831791592213", "97995006831151487182330397022618792276", "3957477968341771052631696777592797300", "255168072077063357165181720630417078083", "248748527251715448121122931650098646170", "278449685286523123134278153224963924984", "123976451317791732623870474327914861332", "186468104317045269724397250198839496898", "293217027885710914558056515617620896992" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6312f6a53fd3ea38125dcaca5e3c9aa7d8a60cf7", "deprecated": false, "target": { "file": "drivers/net/ieee802154/at86rf230.c" }, "signature_type": "Line", "id": "CVE-2022-48794-ea6e23f0" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "207722970236551356475970694708376684564", "7670740649353780980331970739719816673", "59847836328113329851006209570737859275", "203993903396593103037282141831791592213", "97995006831151487182330397022618792276", "3957477968341771052631696777592797300", "255168072077063357165181720630417078083", "248748527251715448121122931650098646170", "278449685286523123134278153224963924984", "123976451317791732623870474327914861332", "186468104317045269724397250198839496898", "293217027885710914558056515617620896992" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@23b2a25382400168427ea278f3d8bf4ecfd333bf", "deprecated": false, "target": { "file": "drivers/net/ieee802154/at86rf230.c" }, "signature_type": "Line", "id": "CVE-2022-48794-eeff9208" }, { "signature_version": "v1", "digest": { "length": 196.0, "function_hash": "205166416311468152486414313041101177425" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@455ef08d6e5473526fa6763f75a93f7198206966", "deprecated": false, "target": { "file": "drivers/net/ieee802154/at86rf230.c", "function": "at86rf230_async_error_recover" }, "signature_type": "Function", "id": "CVE-2022-48794-f29241c0" }, { "signature_version": "v1", "digest": { "length": 196.0, "function_hash": "205166416311468152486414313041101177425" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@23b2a25382400168427ea278f3d8bf4ecfd333bf", "deprecated": false, "target": { "file": "drivers/net/ieee802154/at86rf230.c", "function": "at86rf230_async_error_recover" }, "signature_type": "Function", "id": "CVE-2022-48794-f980079a" } ] }