In the Linux kernel, the following vulnerability has been resolved:
gpio: Restrict usage of GPIO chip irq members before initialization
GPIO chip irq members are exposed before they could be completely initialized and this leads to race conditions.
One such issue was observed for the gc->irq.domain variable which was accessed through the I2C interface in gpiochiptoirq() before it could be initialized by gpiochipaddirqchip(). This resulted in Kernel NULL pointer dereference.
Following are the logs for reference :-
kernel: Call Trace: kernel: gpiodtoirq+0x53/0x70 kernel: acpidevgpioirqgetby+0x113/0x1f0 kernel: i2cacpigetirq+0xc0/0xd0 kernel: i2cdeviceprobe+0x28a/0x2a0 kernel: reallyprobe+0xf2/0x460 kernel: RIP: 0010:gpiochipto_irq+0x47/0xc0
To avoid such scenarios, restrict usage of GPIO chip irq members before they are completely initialized.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49072.json",
"cna_assigner": "Linux"
}"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-49072.json"
[
{
"deprecated": false,
"id": "CVE-2022-49072-04363864",
"digest": {
"length": 1523.0,
"function_hash": "275397371342710173467639896768922729689"
},
"signature_version": "v1",
"target": {
"function": "gpiochip_add_irqchip",
"file": "drivers/gpio/gpiolib.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f8dea54f74cae8c2e4d7b2952e8fed7743a85c87",
"signature_type": "Function"
},
{
"deprecated": false,
"id": "CVE-2022-49072-0986fd57",
"digest": {
"length": 466.0,
"function_hash": "169334057005355801099682486204555112860"
},
"signature_version": "v1",
"target": {
"function": "gpiochip_to_irq",
"file": "drivers/gpio/gpiolib.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5467801f1fcbdc46bc7298a84dbf3ca1ff2a7320",
"signature_type": "Function"
},
{
"deprecated": false,
"id": "CVE-2022-49072-0a5d153a",
"digest": {
"length": 466.0,
"function_hash": "169334057005355801099682486204555112860"
},
"signature_version": "v1",
"target": {
"function": "gpiochip_to_irq",
"file": "drivers/gpio/gpiolib.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0912cf021fb5749372b3782611d8b1de4986c13a",
"signature_type": "Function"
},
{
"deprecated": false,
"id": "CVE-2022-49072-0dde5dd3",
"digest": {
"length": 1418.0,
"function_hash": "291877926924072867087823748478324345559"
},
"signature_version": "v1",
"target": {
"function": "gpiochip_add_irqchip",
"file": "drivers/gpio/gpiolib.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0912cf021fb5749372b3782611d8b1de4986c13a",
"signature_type": "Function"
},
{
"deprecated": false,
"id": "CVE-2022-49072-16af8556",
"digest": {
"threshold": 0.9,
"line_hashes": [
"69226276617033127176293013353373487180",
"219596279797701185248404740608858617188",
"155948315666646065168925873309382316179",
"295314264496834449670062887784711686018",
"12203466108723748168694694732719414002",
"166162907562917648369780790830028916889"
]
},
"signature_version": "v1",
"target": {
"file": "drivers/gpio/gpiolib.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f8dea54f74cae8c2e4d7b2952e8fed7743a85c87",
"signature_type": "Line"
},
{
"deprecated": false,
"id": "CVE-2022-49072-2f0dcef1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"84819868236788387847936233238327619877",
"306896823311572677864626002816838975033",
"257796106328341810569325392459811838499"
]
},
"signature_version": "v1",
"target": {
"file": "include/linux/gpio/driver.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5467801f1fcbdc46bc7298a84dbf3ca1ff2a7320",
"signature_type": "Line"
},
{
"deprecated": false,
"id": "CVE-2022-49072-3174f9bf",
"digest": {
"threshold": 0.9,
"line_hashes": [
"69226276617033127176293013353373487180",
"219596279797701185248404740608858617188",
"155948315666646065168925873309382316179",
"295314264496834449670062887784711686018",
"12203466108723748168694694732719414002",
"166162907562917648369780790830028916889"
]
},
"signature_version": "v1",
"target": {
"file": "drivers/gpio/gpiolib.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0912cf021fb5749372b3782611d8b1de4986c13a",
"signature_type": "Line"
},
{
"deprecated": false,
"id": "CVE-2022-49072-79dcb9e7",
"digest": {
"length": 1557.0,
"function_hash": "14655853370729325341320334752194968392"
},
"signature_version": "v1",
"target": {
"function": "gpiochip_add_irqchip",
"file": "drivers/gpio/gpiolib.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7e88a50704b0c49ad3f2d11e8b963341cf68a89f",
"signature_type": "Function"
},
{
"deprecated": false,
"id": "CVE-2022-49072-88520760",
"digest": {
"threshold": 0.9,
"line_hashes": [
"84819868236788387847936233238327619877",
"306896823311572677864626002816838975033",
"257796106328341810569325392459811838499"
]
},
"signature_version": "v1",
"target": {
"file": "include/linux/gpio/driver.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f8dea54f74cae8c2e4d7b2952e8fed7743a85c87",
"signature_type": "Line"
},
{
"deprecated": false,
"id": "CVE-2022-49072-930c775d",
"digest": {
"threshold": 0.9,
"line_hashes": [
"120971620156648713683756821425764176319",
"216372715732173661665866286187966877557",
"154981826632782829121477900830031238640"
]
},
"signature_version": "v1",
"target": {
"file": "include/linux/gpio/driver.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0912cf021fb5749372b3782611d8b1de4986c13a",
"signature_type": "Line"
},
{
"deprecated": false,
"id": "CVE-2022-49072-99499b4c",
"digest": {
"threshold": 0.9,
"line_hashes": [
"120971620156648713683756821425764176319",
"216372715732173661665866286187966877557",
"154981826632782829121477900830031238640"
]
},
"signature_version": "v1",
"target": {
"file": "include/linux/gpio/driver.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7e88a50704b0c49ad3f2d11e8b963341cf68a89f",
"signature_type": "Line"
},
{
"deprecated": false,
"id": "CVE-2022-49072-9dde2ecf",
"digest": {
"length": 466.0,
"function_hash": "169334057005355801099682486204555112860"
},
"signature_version": "v1",
"target": {
"function": "gpiochip_to_irq",
"file": "drivers/gpio/gpiolib.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c1fa3614795e2b24da1ba95de0b27b8f6ea4537",
"signature_type": "Function"
},
{
"deprecated": false,
"id": "CVE-2022-49072-b46db5d6",
"digest": {
"threshold": 0.9,
"line_hashes": [
"69226276617033127176293013353373487180",
"219596279797701185248404740608858617188",
"155948315666646065168925873309382316179",
"295314264496834449670062887784711686018",
"12203466108723748168694694732719414002",
"166162907562917648369780790830028916889"
]
},
"signature_version": "v1",
"target": {
"file": "drivers/gpio/gpiolib.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5467801f1fcbdc46bc7298a84dbf3ca1ff2a7320",
"signature_type": "Line"
},
{
"deprecated": false,
"id": "CVE-2022-49072-c3ee82dd",
"digest": {
"threshold": 0.9,
"line_hashes": [
"69226276617033127176293013353373487180",
"219596279797701185248404740608858617188",
"155948315666646065168925873309382316179",
"295314264496834449670062887784711686018",
"12203466108723748168694694732719414002",
"166162907562917648369780790830028916889"
]
},
"signature_version": "v1",
"target": {
"file": "drivers/gpio/gpiolib.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c1fa3614795e2b24da1ba95de0b27b8f6ea4537",
"signature_type": "Line"
},
{
"deprecated": false,
"id": "CVE-2022-49072-ca07fee4",
"digest": {
"length": 1523.0,
"function_hash": "275397371342710173467639896768922729689"
},
"signature_version": "v1",
"target": {
"function": "gpiochip_add_irqchip",
"file": "drivers/gpio/gpiolib.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c1fa3614795e2b24da1ba95de0b27b8f6ea4537",
"signature_type": "Function"
},
{
"deprecated": false,
"id": "CVE-2022-49072-ce13b5e3",
"digest": {
"length": 1523.0,
"function_hash": "275397371342710173467639896768922729689"
},
"signature_version": "v1",
"target": {
"function": "gpiochip_add_irqchip",
"file": "drivers/gpio/gpiolib.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5467801f1fcbdc46bc7298a84dbf3ca1ff2a7320",
"signature_type": "Function"
},
{
"deprecated": false,
"id": "CVE-2022-49072-d5a8d98b",
"digest": {
"length": 466.0,
"function_hash": "169334057005355801099682486204555112860"
},
"signature_version": "v1",
"target": {
"function": "gpiochip_to_irq",
"file": "drivers/gpio/gpiolib.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7e88a50704b0c49ad3f2d11e8b963341cf68a89f",
"signature_type": "Function"
},
{
"deprecated": false,
"id": "CVE-2022-49072-e7970250",
"digest": {
"threshold": 0.9,
"line_hashes": [
"84819868236788387847936233238327619877",
"306896823311572677864626002816838975033",
"257796106328341810569325392459811838499"
]
},
"signature_version": "v1",
"target": {
"file": "include/linux/gpio/driver.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c1fa3614795e2b24da1ba95de0b27b8f6ea4537",
"signature_type": "Line"
},
{
"deprecated": false,
"id": "CVE-2022-49072-ea6cb72b",
"digest": {
"length": 466.0,
"function_hash": "169334057005355801099682486204555112860"
},
"signature_version": "v1",
"target": {
"function": "gpiochip_to_irq",
"file": "drivers/gpio/gpiolib.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f8dea54f74cae8c2e4d7b2952e8fed7743a85c87",
"signature_type": "Function"
},
{
"deprecated": false,
"id": "CVE-2022-49072-f9a92d51",
"digest": {
"threshold": 0.9,
"line_hashes": [
"71337142194590634638079328719026276219",
"219596279797701185248404740608858617188",
"155948315666646065168925873309382316179",
"295314264496834449670062887784711686018",
"12203466108723748168694694732719414002",
"166162907562917648369780790830028916889"
]
},
"signature_version": "v1",
"target": {
"file": "drivers/gpio/gpiolib.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7e88a50704b0c49ad3f2d11e8b963341cf68a89f",
"signature_type": "Line"
}
]