CVE-2022-49010

EUVD-2022-53894

21.10.2024, 20:15

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (coretemp) Check for null before removing sysfs attrs

If coretemp_add_core() gets an error then pdata->core_data[indx]
is already NULL and has been kfreed. Don't pass that to
sysfs_remove_group() as that will crash in sysfs_remove_group().

[Shortened for readability]
[91854.020159] sysfs: cannot create duplicate filename '/devices/platform/coretemp.0/hwmon/hwmon2/temp20_label'
<cpu offline>
[91855.126115] BUG: kernel NULL pointer dereference, address: 0000000000000188
[91855.165103] #PF: supervisor read access in kernel mode
[91855.194506] #PF: error_code(0x0000) - not-present page
[91855.224445] PGD 0 P4D 0
[91855.238508] Oops: 0000 [#1] PREEMPT SMP PTI
...
[91855.342716] RIP: 0010:sysfs_remove_group+0xc/0x80
...
[91855.796571] Call Trace:
[91855.810524]  coretemp_cpu_offline+0x12b/0x1dd [coretemp]
[91855.841738]  ? coretemp_cpu_online+0x180/0x180 [coretemp]
[91855.871107]  cpuhp_invoke_callback+0x105/0x4b0
[91855.893432]  cpuhp_thread_fun+0x8e/0x150
...

Fix this by checking for NULL first.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	5.5 MEDIUM	LOCAL	LOW	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 1%

Affected Products (NVD)

Vendor	Product	Version
linux	linux_kernel	3.0 ≤ 𝑥 < 4.9.335
linux	linux_kernel	4.10 ≤ 𝑥 < 4.14.301
linux	linux_kernel	4.15 ≤ 𝑥 < 4.19.268
linux	linux_kernel	4.20 ≤ 𝑥 < 5.4.226
linux	linux_kernel	5.5 ≤ 𝑥 < 5.10.158
linux	linux_kernel	5.11 ≤ 𝑥 < 5.15.82
linux	linux_kernel	5.16 ≤ 𝑥 < 6.0.12
linux	linux_kernel	6.1:rc1
linux	linux_kernel	6.1:rc2
linux	linux_kernel	6.1:rc3
linux	linux_kernel	6.1:rc4
linux	linux_kernel	6.1:rc5
linux	linux_kernel	6.1:rc6
linux	linux_kernel	6.1:rc7

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

linux

bookworm	6.1.106-3 fixed
bookworm (security)	6.1.112-1 fixed
bullseye	5.10.223-1 fixed
bullseye (security)	5.10.226-1 fixed
sid	6.11.5-1 fixed
trixie	6.11.5-1 fixed

openSUSE / SLES Releases

openSUSE Product

Release

cluster-md-kmp-default

suse enterprise server 12 SP5

4.12.14-122.234.1

fixed

dlm-kmp-default

suse enterprise server 12 SP5

4.12.14-122.234.1

fixed

gfs2-kmp-default

suse enterprise server 12 SP5

4.12.14-122.234.1

fixed

kernel-64kb

suse enterprise desktop 15 SP5	5.14.21-150500.55.88.1 fixed
suse enterprise sap 15 SP5	5.14.21-150500.55.88.1 fixed
suse enterprise server 15 SP3	5.3.18-150300.59.185.1 fixed
suse enterprise server 15 SP4	5.14.21-150400.24.141.1 fixed
suse enterprise server 15 SP5	5.14.21-150500.55.88.1 fixed

kernel-azure

suse enterprise sap 15 SP5	5.14.21-150500.33.72.1 fixed
suse enterprise server 15 SP5	5.14.21-150500.33.72.1 fixed

kernel-default

suse enterprise desktop 15 SP5	5.14.21-150500.55.88.1 fixed
suse enterprise sap 15 SP5	5.14.21-150500.55.88.1 fixed
suse enterprise server 12 SP5	4.12.14-122.234.1 fixed
suse enterprise server 15 SP3	5.3.18-150300.59.185.1 fixed
suse enterprise server 15 SP4	5.14.21-150400.24.141.1 fixed
suse enterprise server 15 SP5	5.14.21-150500.55.88.1 fixed

kernel-default-base

suse enterprise desktop 15 SP5	5.14.21-150500.55.88.1.150500.6.39.4 fixed
suse enterprise sap 15 SP5	5.14.21-150500.55.88.1.150500.6.39.4 fixed
suse enterprise server 12 SP5	4.12.14-122.234.1 fixed
suse enterprise server 15 SP3	5.3.18-150300.59.185.1.150300.18.109.1 fixed
suse enterprise server 15 SP4	5.14.21-150400.24.141.1.150400.24.68.2 fixed
suse enterprise server 15 SP5	5.14.21-150500.55.88.1.150500.6.39.4 fixed

kernel-default-man

suse enterprise server 12 SP5

4.12.14-122.234.1

fixed

kernel-docs

suse enterprise desktop 15 SP5	5.14.21-150500.55.88.1 fixed
suse enterprise sap 15 SP5	5.14.21-150500.55.88.1 fixed
suse enterprise server 15 SP3	5.3.18-150300.59.185.1 fixed
suse enterprise server 15 SP4	5.14.21-150400.24.141.1 fixed
suse enterprise server 15 SP5	5.14.21-150500.55.88.1 fixed

kernel-macros

suse enterprise desktop 15 SP5	5.14.21-150500.55.88.1 fixed
suse enterprise sap 15 SP5	5.14.21-150500.55.88.1 fixed
suse enterprise server 12 SP5	4.12.14-122.234.1 fixed
suse enterprise server 15 SP3	5.3.18-150300.59.185.1 fixed
suse enterprise server 15 SP4	5.14.21-150400.24.141.1 fixed
suse enterprise server 15 SP5	5.14.21-150500.55.88.1 fixed

kernel-obs-build

suse enterprise desktop 15 SP5	5.14.21-150500.55.88.1 fixed
suse enterprise sap 15 SP5	5.14.21-150500.55.88.1 fixed
suse enterprise server 15 SP3	5.3.18-150300.59.185.1 fixed
suse enterprise server 15 SP4	5.14.21-150400.24.141.1 fixed
suse enterprise server 15 SP5	5.14.21-150500.55.88.1 fixed

kernel-preempt

suse enterprise server 15 SP3

5.3.18-150300.59.185.1

fixed

kernel-source

suse enterprise desktop 15 SP5	5.14.21-150500.55.88.1 fixed
suse enterprise sap 15 SP5	5.14.21-150500.55.88.1 fixed
suse enterprise server 12 SP5	4.12.14-122.234.1 fixed
suse enterprise server 15 SP3	5.3.18-150300.59.185.1 fixed
suse enterprise server 15 SP4	5.14.21-150400.24.141.1 fixed
suse enterprise server 15 SP5	5.14.21-150500.55.88.1 fixed

kernel-source-azure

suse enterprise sap 15 SP5	5.14.21-150500.33.72.1 fixed
suse enterprise server 15 SP5	5.14.21-150500.33.72.1 fixed

kernel-syms

suse enterprise desktop 15 SP5	5.14.21-150500.55.88.1 fixed
suse enterprise sap 15 SP5	5.14.21-150500.55.88.1 fixed
suse enterprise server 12 SP5	4.12.14-122.234.1 fixed
suse enterprise server 15 SP3	5.3.18-150300.59.185.1 fixed
suse enterprise server 15 SP4	5.14.21-150400.24.141.1 fixed
suse enterprise server 15 SP5	5.14.21-150500.55.88.1 fixed

kernel-syms-azure

suse enterprise sap 15 SP5	5.14.21-150500.33.72.1 fixed
suse enterprise server 15 SP5	5.14.21-150500.33.72.1 fixed

kernel-zfcpdump

suse enterprise desktop 15 SP5	5.14.21-150500.55.88.1 fixed
suse enterprise sap 15 SP5	5.14.21-150500.55.88.1 fixed
suse enterprise server 15 SP3	5.3.18-150300.59.185.1 fixed
suse enterprise server 15 SP4	5.14.21-150400.24.141.1 fixed
suse enterprise server 15 SP5	5.14.21-150500.55.88.1 fixed

ocfs2-kmp-default

suse enterprise server 12 SP5

4.12.14-122.234.1

fixed

reiserfs-kmp-default

suse enterprise server 15 SP3	5.3.18-150300.59.185.1 fixed
suse enterprise server 15 SP4	5.14.21-150400.24.141.1 fixed

Red Hat Enterprise Linux Releases

Red Hat Product

Release

bpftool

RHEL 8	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 AUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 E4S	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 EUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 TUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 9	0:7.0.0-284.11.1.el9_2 fixed

kernel

RHEL 8	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 AUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 E4S	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 EUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 TUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 9	0:5.14.0-284.11.1.el9_2 fixed

kernel-64k

RHEL 9

0:5.14.0-284.11.1.el9_2

fixed

kernel-64k-core

RHEL 9

0:5.14.0-284.11.1.el9_2

fixed

kernel-64k-debug

RHEL 9

0:5.14.0-284.11.1.el9_2

fixed

kernel-64k-debug-core

RHEL 9

0:5.14.0-284.11.1.el9_2

fixed

kernel-64k-debug-devel

RHEL 9

0:5.14.0-284.11.1.el9_2

fixed

kernel-64k-debug-devel-matched

RHEL 9

0:5.14.0-284.11.1.el9_2

fixed

kernel-64k-debug-modules

RHEL 9

0:5.14.0-284.11.1.el9_2

fixed

kernel-64k-debug-modules-core

RHEL 9

0:5.14.0-284.11.1.el9_2

fixed

kernel-64k-debug-modules-extra

RHEL 9

0:5.14.0-284.11.1.el9_2

fixed

kernel-64k-devel

RHEL 9

0:5.14.0-284.11.1.el9_2

fixed

kernel-64k-devel-matched

RHEL 9

0:5.14.0-284.11.1.el9_2

fixed

kernel-64k-modules

RHEL 9

0:5.14.0-284.11.1.el9_2

fixed

kernel-64k-modules-core

RHEL 9

0:5.14.0-284.11.1.el9_2

fixed

kernel-64k-modules-extra

RHEL 9

0:5.14.0-284.11.1.el9_2

fixed

kernel-abi-stablelists

RHEL 8	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 AUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 E4S	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 EUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 TUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 9	0:5.14.0-284.11.1.el9_2 fixed

kernel-core

RHEL 8	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 AUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 E4S	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 EUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 TUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 9	0:5.14.0-284.11.1.el9_2 fixed

kernel-debug

RHEL 8	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 AUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 E4S	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 EUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 TUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 9	0:5.14.0-284.11.1.el9_2 fixed

kernel-debug-core

RHEL 8	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 AUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 E4S	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 EUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 TUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 9	0:5.14.0-284.11.1.el9_2 fixed

kernel-debug-devel

RHEL 8	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 AUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 E4S	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 EUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 TUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 9	0:5.14.0-284.11.1.el9_2 fixed

kernel-debug-devel-matched

RHEL 9

0:5.14.0-284.11.1.el9_2

fixed

kernel-debug-modules

RHEL 8	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 AUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 E4S	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 EUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 TUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 9	0:5.14.0-284.11.1.el9_2 fixed

kernel-debug-modules-core

RHEL 9

0:5.14.0-284.11.1.el9_2

fixed

kernel-debug-modules-extra

RHEL 8	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 AUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 E4S	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 EUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 TUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 9	0:5.14.0-284.11.1.el9_2 fixed

kernel-debug-uki-virt

RHEL 9

0:5.14.0-284.11.1.el9_2

fixed

kernel-devel

RHEL 8	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 AUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 E4S	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 EUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 TUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 9	0:5.14.0-284.11.1.el9_2 fixed

kernel-devel-matched

RHEL 9

0:5.14.0-284.11.1.el9_2

fixed

kernel-doc

RHEL 8	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 AUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 E4S	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 EUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 TUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 9	0:5.14.0-284.11.1.el9_2 fixed

kernel-modules

RHEL 8	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 AUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 E4S	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 EUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 TUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 9	0:5.14.0-284.11.1.el9_2 fixed

kernel-modules-core

RHEL 9

0:5.14.0-284.11.1.el9_2

fixed

kernel-modules-extra

RHEL 8	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 AUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 E4S	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 EUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 TUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 9	0:5.14.0-284.11.1.el9_2 fixed

kernel-tools

RHEL 8	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 AUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 E4S	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 EUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 TUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 9	0:5.14.0-284.11.1.el9_2 fixed

kernel-tools-libs

RHEL 8	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 AUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 E4S	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 EUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 TUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 9	0:5.14.0-284.11.1.el9_2 fixed

kernel-tools-libs-devel

RHEL 8	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 AUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 E4S	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 EUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 TUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 9	0:5.14.0-284.11.1.el9_2 fixed

kernel-uki-virt

RHEL 9

0:5.14.0-284.11.1.el9_2

fixed

kernel-zfcpdump

RHEL 8	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 AUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 E4S	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 EUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 TUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 9	0:5.14.0-284.11.1.el9_2 fixed

kernel-zfcpdump-core

RHEL 8	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 AUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 E4S	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 EUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 TUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 9	0:5.14.0-284.11.1.el9_2 fixed

kernel-zfcpdump-devel

RHEL 8	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 AUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 E4S	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 EUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 TUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 9	0:5.14.0-284.11.1.el9_2 fixed

kernel-zfcpdump-devel-matched

RHEL 9

0:5.14.0-284.11.1.el9_2

fixed

kernel-zfcpdump-modules

RHEL 8	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 AUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 E4S	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 EUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 TUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 9	0:5.14.0-284.11.1.el9_2 fixed

kernel-zfcpdump-modules-core

RHEL 9

0:5.14.0-284.11.1.el9_2

fixed

kernel-zfcpdump-modules-extra

RHEL 8	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 AUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 E4S	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 EUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 TUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 9	0:5.14.0-284.11.1.el9_2 fixed

perf

RHEL 8	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 AUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 E4S	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 EUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 TUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 9	0:5.14.0-284.11.1.el9_2 fixed

python3-perf

RHEL 8	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 AUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 E4S	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 EUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 8.8 TUS	0:4.18.0-477.10.1.el8_8 fixed
RHEL 9	0:5.14.0-284.11.1.el9_2 fixed

rtla

RHEL 9

0:5.14.0-284.11.1.el9_2

fixed

Common Weakness Enumeration

CWE-476 - NULL Pointer Dereference
A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.

References

https://git.kernel.org/stable/c/070d5ea4a0592a37ad96ce7f7b6b024f90bb009f

https://git.kernel.org/stable/c/280110db1a7d62ad635b103bafc3ae96e8bef75c

https://git.kernel.org/stable/c/7692700ac818866d138a8de555130a6e70e6ac16

https://git.kernel.org/stable/c/89eecabe6a47403237f45aafd7d24f93cb973653

https://git.kernel.org/stable/c/a89ff5f5cc64b9fe7a992cf56988fd36f56ca82a

https://git.kernel.org/stable/c/ae6c8b6e5d5628df1c475c0a8fca1465e205c95b

https://git.kernel.org/stable/c/f06e0cd01eab954bd5f2190c9faa79bb5357e05b

https://git.kernel.org/stable/c/fb503d077ff7b43913503eaf72995d1239028b99