In the Linux kernel, the following vulnerability has been resolved:
hwmon: (ibmpex) Fix possible UAF when ibmpexregisterbmc() fails
Smatch report warning as follows:
drivers/hwmon/ibmpex.c:509 ibmpexregisterbmc() warn: '&data->list' not removed from list
If ibmpexfindsensors() fails in ibmpexregisterbmc(), data will be freed, but data->list will not be removed from driverdata.bmcdata, then list traversal may cause UAF.
Fix by removeing it from driverdata.bmcdata before free().
{ "vanir_signatures": [ { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e65cfd1f9cd27d9c27ee5cb88128a9f79f25d863", "target": { "file": "drivers/hwmon/ibmpex.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "281749271965227060535972145732450086628", "282919481582442404649795333074680389001", "167164877962528375993406512386629807357", "155670715107179055012552341511185554558" ] }, "deprecated": false, "id": "CVE-2022-49029-014a4fc2", "signature_type": "Line", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@798198273bf86673b970b51acdb35e57f42b3fcb", "target": { "file": "drivers/hwmon/ibmpex.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "281749271965227060535972145732450086628", "282919481582442404649795333074680389001", "167164877962528375993406512386629807357", "155670715107179055012552341511185554558" ] }, "deprecated": false, "id": "CVE-2022-49029-0d9e9299", "signature_type": "Line", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@798198273bf86673b970b51acdb35e57f42b3fcb", "target": { "file": "drivers/hwmon/ibmpex.c", "function": "ibmpex_register_bmc" }, "digest": { "length": 1394.0, "function_hash": "191273625958169565234496615465203725713" }, "deprecated": false, "id": "CVE-2022-49029-32f8dc70", "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f2a13196ad41c6c2ab058279dffe6c97292e753a", "target": { "file": "drivers/hwmon/ibmpex.c", "function": "ibmpex_register_bmc" }, "digest": { "length": 1394.0, "function_hash": "191273625958169565234496615465203725713" }, "deprecated": false, "id": "CVE-2022-49029-3c53b791", "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e65cfd1f9cd27d9c27ee5cb88128a9f79f25d863", "target": { "file": "drivers/hwmon/ibmpex.c", "function": "ibmpex_register_bmc" }, "digest": { "length": 1394.0, "function_hash": "191273625958169565234496615465203725713" }, "deprecated": false, "id": "CVE-2022-49029-58597f54", "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e2a87785aab0dac190ac89be6a9ba955e2c634f2", "target": { "file": "drivers/hwmon/ibmpex.c", "function": "ibmpex_register_bmc" }, "digest": { "length": 1394.0, "function_hash": "191273625958169565234496615465203725713" }, "deprecated": false, "id": "CVE-2022-49029-69e24bec", "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e2a87785aab0dac190ac89be6a9ba955e2c634f2", "target": { "file": "drivers/hwmon/ibmpex.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "281749271965227060535972145732450086628", "282919481582442404649795333074680389001", "167164877962528375993406512386629807357", "155670715107179055012552341511185554558" ] }, "deprecated": false, "id": "CVE-2022-49029-76b208a5", "signature_type": "Line", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b2b67fe1339389e0bf3c37c7a677a004ac0e4e3", "target": { "file": "drivers/hwmon/ibmpex.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "281749271965227060535972145732450086628", "282919481582442404649795333074680389001", "167164877962528375993406512386629807357", "155670715107179055012552341511185554558" ] }, "deprecated": false, "id": "CVE-2022-49029-96fcfd71", "signature_type": "Line", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@24b9633f7db7f4809be7053df1d2e117e7c2de10", "target": { "file": "drivers/hwmon/ibmpex.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "281749271965227060535972145732450086628", "282919481582442404649795333074680389001", "167164877962528375993406512386629807357", "155670715107179055012552341511185554558" ] }, "deprecated": false, "id": "CVE-2022-49029-a7348bcf", "signature_type": "Line", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90907cd4d11351ff76c9a447bcb5db0e264c47cd", "target": { "file": "drivers/hwmon/ibmpex.c", "function": "ibmpex_register_bmc" }, "digest": { "length": 1394.0, "function_hash": "191273625958169565234496615465203725713" }, "deprecated": false, "id": "CVE-2022-49029-ccc5cad1", "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@45f6e81863747c0d7bc6a95ec51129900e71467a", "target": { "file": "drivers/hwmon/ibmpex.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "281749271965227060535972145732450086628", "282919481582442404649795333074680389001", "167164877962528375993406512386629807357", "155670715107179055012552341511185554558" ] }, "deprecated": false, "id": "CVE-2022-49029-d01c3ee5", "signature_type": "Line", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@24b9633f7db7f4809be7053df1d2e117e7c2de10", "target": { "file": "drivers/hwmon/ibmpex.c", "function": "ibmpex_register_bmc" }, "digest": { "length": 1394.0, "function_hash": "191273625958169565234496615465203725713" }, "deprecated": false, "id": "CVE-2022-49029-d039d928", "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@45f6e81863747c0d7bc6a95ec51129900e71467a", "target": { "file": "drivers/hwmon/ibmpex.c", "function": "ibmpex_register_bmc" }, "digest": { "length": 1394.0, "function_hash": "191273625958169565234496615465203725713" }, "deprecated": false, "id": "CVE-2022-49029-dc482976", "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b2b67fe1339389e0bf3c37c7a677a004ac0e4e3", "target": { "file": "drivers/hwmon/ibmpex.c", "function": "ibmpex_register_bmc" }, "digest": { "length": 1394.0, "function_hash": "191273625958169565234496615465203725713" }, "deprecated": false, "id": "CVE-2022-49029-dfdd245e", "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f2a13196ad41c6c2ab058279dffe6c97292e753a", "target": { "file": "drivers/hwmon/ibmpex.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "281749271965227060535972145732450086628", "282919481582442404649795333074680389001", "167164877962528375993406512386629807357", "155670715107179055012552341511185554558" ] }, "deprecated": false, "id": "CVE-2022-49029-f2388a70", "signature_type": "Line", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90907cd4d11351ff76c9a447bcb5db0e264c47cd", "target": { "file": "drivers/hwmon/ibmpex.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "281749271965227060535972145732450086628", "282919481582442404649795333074680389001", "167164877962528375993406512386629807357", "155670715107179055012552341511185554558" ] }, "deprecated": false, "id": "CVE-2022-49029-f3c1f32b", "signature_type": "Line", "signature_version": "v1" } ] }