CVE-2022-48865
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2022-48865
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-48865.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2022-48865
- Downstream
- Related
- Published
- 2024-07-16T12:25:27Z
- Modified
- 2025-10-15T16:03:24.343354Z
- Summary
- tipc: fix kernel panic when enabling bearer
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
tipc: fix kernel panic when enabling bearer
When enabling a bearer on a node, a kernel panic is observed:
[ 4.498085] RIP: 0010:tipcmonprep+0x4e/0x130 [tipc] ... [ 4.520030] Call Trace: [ 4.520689] <IRQ> [ 4.521236] tipclinkbuildprotomsg+0x375/0x750 [tipc] [ 4.522654] tipclinkbuildstatemsg+0x48/0xc0 [tipc] [ 4.524034] _tipcnodelinkup+0xd7/0x290 [tipc] [ 4.525292] tipcrcv+0x5da/0x730 [tipc] [ 4.526346] ? _netifreceiveskbcore+0xb7/0xfc0 [ 4.527601] tipcl2rcvmsg+0x5e/0x90 [tipc] [ 4.528737] _netifreceiveskblistcore+0x20b/0x260 [ 4.530068] netifreceiveskblistinternal+0x1bf/0x2e0 [ 4.531450] ? devgroreceive+0x4c2/0x680 [ 4.532512] napicompletedone+0x6f/0x180 [ 4.533570] virtnetpoll+0x29c/0x42e [virtio_net] ...
The node in question is receiving activate messages in another thread after changing bearer status to allow message sending/ receiving in current thread:
thread 1 | thread 2 -------- | -------- |tipcenablebearer() | testandsetbitlock() | tipcbearerxmitskb() | | tipcl2rcvmsg() | tipcrcv() | _tipcnodelinkup() | tipclinkbuildstatemsg() | tipclinkbuildprotomsg() | tipcmonprep() | { | ... | // null-pointer dereference | u16 gen = mon->domgen; | ... | } // Not being executed yet | tipcmoncreate() | { | ... | // allocate | mon = kzalloc(); | ... | } |
Monitoring pointer in thread 2 is dereferenced before monitoring data is allocated in thread 1. This causes kernel panic.
This commit fixes it by allocating the monitoring data before enabling the bearer to receive messages.
- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/2de76d37d4a6dca9b96ea51da24d4290e6cfa1a5
- https://git.kernel.org/stable/c/be4977b847f5d5cedb64d50eaaf2218c3a55a3a3
- https://git.kernel.org/stable/c/f4f59fdbc748805b08c13dae14c01f0518c77c94
- https://git.kernel.org/stable/c/f96dc3adb9a97b8f3dfdb88796483491a3006b71
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced35c55c9877f8de0ab129fa1a309271d0ecc868b9Fixed2de76d37d4a6dca9b96ea51da24d4290e6cfa1a5
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced35c55c9877f8de0ab129fa1a309271d0ecc868b9Fixedf96dc3adb9a97b8f3dfdb88796483491a3006b71
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced35c55c9877f8de0ab129fa1a309271d0ecc868b9Fixedf4f59fdbc748805b08c13dae14c01f0518c77c94
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced35c55c9877f8de0ab129fa1a309271d0ecc868b9Fixedbe4977b847f5d5cedb64d50eaaf2218c3a55a3a3
Affected versions
v4.*
v5.*
Database specific
vanir_signatures
[
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"260495014474219130192019687510802083277",
"269521071537358867445350056628291965962",
"195324117045704585866110040327687169022",
"14789781464074043938415019305880145224",
"190819356290755548526799921132613081558",
"136463705290066715814988006907395510536",
"15545066793421535326420348874242697674",
"118652780174501687464958826698224165230",
"19968785441936340380452332855070037196",
"151798649054507161706994654001256375526",
"216081378577141040465385909046938774628"
]
},
"signature_type": "Line",
"target": {
"file": "net/tipc/bearer.c"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@be4977b847f5d5cedb64d50eaaf2218c3a55a3a3",
"signature_version": "v1",
"id": "CVE-2022-48865-02113960"
},
{
"digest": {
"function_hash": "232756383241282899626418742109612803885",
"length": 2782.0
},
"signature_type": "Function",
"target": {
"function": "tipc_enable_bearer",
"file": "net/tipc/bearer.c"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f4f59fdbc748805b08c13dae14c01f0518c77c94",
"signature_version": "v1",
"id": "CVE-2022-48865-0bead8d4"
},
{
"digest": {
"function_hash": "232756383241282899626418742109612803885",
"length": 2782.0
},
"signature_type": "Function",
"target": {
"function": "tipc_enable_bearer",
"file": "net/tipc/bearer.c"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@be4977b847f5d5cedb64d50eaaf2218c3a55a3a3",
"signature_version": "v1",
"id": "CVE-2022-48865-1401a30a"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"260495014474219130192019687510802083277",
"269521071537358867445350056628291965962",
"195324117045704585866110040327687169022",
"14789781464074043938415019305880145224",
"190819356290755548526799921132613081558",
"136463705290066715814988006907395510536",
"15545066793421535326420348874242697674",
"118652780174501687464958826698224165230",
"19968785441936340380452332855070037196",
"151798649054507161706994654001256375526",
"216081378577141040465385909046938774628"
]
},
"signature_type": "Line",
"target": {
"file": "net/tipc/bearer.c"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f4f59fdbc748805b08c13dae14c01f0518c77c94",
"signature_version": "v1",
"id": "CVE-2022-48865-32435529"
},
{
"digest": {
"function_hash": "232756383241282899626418742109612803885",
"length": 2782.0
},
"signature_type": "Function",
"target": {
"function": "tipc_enable_bearer",
"file": "net/tipc/bearer.c"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2de76d37d4a6dca9b96ea51da24d4290e6cfa1a5",
"signature_version": "v1",
"id": "CVE-2022-48865-53d7dda7"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"260495014474219130192019687510802083277",
"269521071537358867445350056628291965962",
"195324117045704585866110040327687169022",
"14789781464074043938415019305880145224",
"190819356290755548526799921132613081558",
"136463705290066715814988006907395510536",
"15545066793421535326420348874242697674",
"118652780174501687464958826698224165230",
"19968785441936340380452332855070037196",
"151798649054507161706994654001256375526",
"216081378577141040465385909046938774628"
]
},
"signature_type": "Line",
"target": {
"file": "net/tipc/bearer.c"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2de76d37d4a6dca9b96ea51da24d4290e6cfa1a5",
"signature_version": "v1",
"id": "CVE-2022-48865-ab6b45db"
}
]