cve-2022-48812
Vulnerability from cvelistv5
Published
2024-07-16 11:44
Modified
2024-12-19 08:08
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: net: dsa: lantiq_gswip: don't use devres for mdiobus As explained in commits: 74b6d7d13307 ("net: dsa: realtek: register the MDIO bus under devres") 5135e96a3dd2 ("net: dsa: don't allocate the slave_mii_bus using devres") mdiobus_free() will panic when called from devm_mdiobus_free() <- devres_release_all() <- __device_release_driver(), and that mdiobus was not previously unregistered. The GSWIP switch is a platform device, so the initial set of constraints that I thought would cause this (I2C or SPI buses which call ->remove on ->shutdown) do not apply. But there is one more which applies here. If the DSA master itself is on a bus that calls ->remove from ->shutdown (like dpaa2-eth, which is on the fsl-mc bus), there is a device link between the switch and the DSA master, and device_links_unbind_consumers() will unbind the GSWIP switch driver on shutdown. So the same treatment must be applied to all DSA switch drivers, which is: either use devres for both the mdiobus allocation and registration, or don't use devres at all. The gswip driver has the code structure in place for orderly mdiobus removal, so just replace devm_mdiobus_alloc() with the non-devres variant, and add manual free where necessary, to ensure that we don't let devres free a still-registered bus.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/0d120dfb5d67edc5bcd1804e167dba2b30809afd
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/2443ba2fe396bdde187a2fdfa6a57375643ae93c
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b5652bc50dde7b84e93dfb25479b64b817e377c1
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e177d2e85ebcd3008c4b2abc293f4118e04eedef
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/0d120dfb5d67edc5bcd1804e167dba2b30809afd
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/2443ba2fe396bdde187a2fdfa6a57375643ae93c
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/b5652bc50dde7b84e93dfb25479b64b817e377c1
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/e177d2e85ebcd3008c4b2abc293f4118e04eedef
Impacted products
Vendor Product Version
Linux Linux Version: ac3a68d56651c3dad2c12c7afce065fe15267f44
Version: ac3a68d56651c3dad2c12c7afce065fe15267f44
Version: ac3a68d56651c3dad2c12c7afce065fe15267f44
Version: ac3a68d56651c3dad2c12c7afce065fe15267f44
 Create a notification for this product.
   Linux Linux Version: 5.9
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T15:25:01.549Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://git.kernel.org/stable/c/e177d2e85ebcd3008c4b2abc293f4118e04eedef",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://git.kernel.org/stable/c/b5652bc50dde7b84e93dfb25479b64b817e377c1",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://git.kernel.org/stable/c/2443ba2fe396bdde187a2fdfa6a57375643ae93c",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://git.kernel.org/stable/c/0d120dfb5d67edc5bcd1804e167dba2b30809afd",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-48812",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-09-10T16:58:28.399914Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-09-11T17:34:13.070Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "Linux",
               programFiles: [
                  "drivers/net/dsa/lantiq_gswip.c",
               ],
               repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               vendor: "Linux",
               versions: [
                  {
                     lessThan: "e177d2e85ebcd3008c4b2abc293f4118e04eedef",
                     status: "affected",
                     version: "ac3a68d56651c3dad2c12c7afce065fe15267f44",
                     versionType: "git",
                  },
                  {
                     lessThan: "b5652bc50dde7b84e93dfb25479b64b817e377c1",
                     status: "affected",
                     version: "ac3a68d56651c3dad2c12c7afce065fe15267f44",
                     versionType: "git",
                  },
                  {
                     lessThan: "2443ba2fe396bdde187a2fdfa6a57375643ae93c",
                     status: "affected",
                     version: "ac3a68d56651c3dad2c12c7afce065fe15267f44",
                     versionType: "git",
                  },
                  {
                     lessThan: "0d120dfb5d67edc5bcd1804e167dba2b30809afd",
                     status: "affected",
                     version: "ac3a68d56651c3dad2c12c7afce065fe15267f44",
                     versionType: "git",
                  },
               ],
            },
            {
               defaultStatus: "affected",
               product: "Linux",
               programFiles: [
                  "drivers/net/dsa/lantiq_gswip.c",
               ],
               repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               vendor: "Linux",
               versions: [
                  {
                     status: "affected",
                     version: "5.9",
                  },
                  {
                     lessThan: "5.9",
                     status: "unaffected",
                     version: "0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "5.10.*",
                     status: "unaffected",
                     version: "5.10.101",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "5.15.*",
                     status: "unaffected",
                     version: "5.15.24",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "5.16.*",
                     status: "unaffected",
                     version: "5.16.10",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "*",
                     status: "unaffected",
                     version: "5.17",
                     versionType: "original_commit_for_fix",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: lantiq_gswip: don't use devres for mdiobus\n\nAs explained in commits:\n74b6d7d13307 (\"net: dsa: realtek: register the MDIO bus under devres\")\n5135e96a3dd2 (\"net: dsa: don't allocate the slave_mii_bus using devres\")\n\nmdiobus_free() will panic when called from devm_mdiobus_free() <-\ndevres_release_all() <- __device_release_driver(), and that mdiobus was\nnot previously unregistered.\n\nThe GSWIP switch is a platform device, so the initial set of constraints\nthat I thought would cause this (I2C or SPI buses which call ->remove on\n->shutdown) do not apply. But there is one more which applies here.\n\nIf the DSA master itself is on a bus that calls ->remove from ->shutdown\n(like dpaa2-eth, which is on the fsl-mc bus), there is a device link\nbetween the switch and the DSA master, and device_links_unbind_consumers()\nwill unbind the GSWIP switch driver on shutdown.\n\nSo the same treatment must be applied to all DSA switch drivers, which\nis: either use devres for both the mdiobus allocation and registration,\nor don't use devres at all.\n\nThe gswip driver has the code structure in place for orderly mdiobus\nremoval, so just replace devm_mdiobus_alloc() with the non-devres\nvariant, and add manual free where necessary, to ensure that we don't\nlet devres free a still-registered bus.",
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-12-19T08:08:12.366Z",
            orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            shortName: "Linux",
         },
         references: [
            {
               url: "https://git.kernel.org/stable/c/e177d2e85ebcd3008c4b2abc293f4118e04eedef",
            },
            {
               url: "https://git.kernel.org/stable/c/b5652bc50dde7b84e93dfb25479b64b817e377c1",
            },
            {
               url: "https://git.kernel.org/stable/c/2443ba2fe396bdde187a2fdfa6a57375643ae93c",
            },
            {
               url: "https://git.kernel.org/stable/c/0d120dfb5d67edc5bcd1804e167dba2b30809afd",
            },
         ],
         title: "net: dsa: lantiq_gswip: don't use devres for mdiobus",
         x_generator: {
            engine: "bippy-5f407fcff5a0",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      assignerShortName: "Linux",
      cveId: "CVE-2022-48812",
      datePublished: "2024-07-16T11:44:01.907Z",
      dateReserved: "2024-07-16T11:38:08.898Z",
      dateUpdated: "2024-12-19T08:08:12.366Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      nvd: "{\"cve\":{\"id\":\"CVE-2022-48812\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-07-16T12:15:05.430\",\"lastModified\":\"2024-11-21T07:34:08.123\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: dsa: lantiq_gswip: don't use devres for mdiobus\\n\\nAs explained in commits:\\n74b6d7d13307 (\\\"net: dsa: realtek: register the MDIO bus under devres\\\")\\n5135e96a3dd2 (\\\"net: dsa: don't allocate the slave_mii_bus using devres\\\")\\n\\nmdiobus_free() will panic when called from devm_mdiobus_free() <-\\ndevres_release_all() <- __device_release_driver(), and that mdiobus was\\nnot previously unregistered.\\n\\nThe GSWIP switch is a platform device, so the initial set of constraints\\nthat I thought would cause this (I2C or SPI buses which call ->remove on\\n->shutdown) do not apply. But there is one more which applies here.\\n\\nIf the DSA master itself is on a bus that calls ->remove from ->shutdown\\n(like dpaa2-eth, which is on the fsl-mc bus), there is a device link\\nbetween the switch and the DSA master, and device_links_unbind_consumers()\\nwill unbind the GSWIP switch driver on shutdown.\\n\\nSo the same treatment must be applied to all DSA switch drivers, which\\nis: either use devres for both the mdiobus allocation and registration,\\nor don't use devres at all.\\n\\nThe gswip driver has the code structure in place for orderly mdiobus\\nremoval, so just replace devm_mdiobus_alloc() with the non-devres\\nvariant, and add manual free where necessary, to ensure that we don't\\nlet devres free a still-registered bus.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: dsa: lantiq_gswip: no use devres para mdiobus Como se explica en los commits: 74b6d7d13307 (\\\"net: dsa: realtek: registre el bus MDIO en devres\\\") 5135e96a3dd2 (\\\" net: dsa: no asigne el esclavo_mii_bus usando devres\\\") mdiobus_free() entrará en pánico cuando se llame desde devm_mdiobus_free() &lt;- devres_release_all() &lt;- __device_release_driver(), y ese mdiobus no fue anulado previamente. El conmutador GSWIP es un dispositivo de plataforma, por lo que el conjunto inicial de restricciones que pensé que causaría esto (buses I2C o SPI que llaman -&gt;eliminar activado -&gt;apagar) no se aplican. Pero hay algo más que se aplica aquí. Si el maestro DSA está en un bus que llama -&gt;remove from -&gt;shutdown (como dpaa2-eth, que está en el bus fsl-mc), hay un enlace de dispositivo entre el conmutador y el maestro DSA, y device_links_unbind_consumers( ) desvinculará el controlador del conmutador GSWIP al apagar. Por lo tanto, se debe aplicar el mismo tratamiento a todos los controladores de conmutador DSA, que es: usar devres tanto para la asignación como para el registro de mdiobus, o no usar devres en absoluto. El controlador gswip tiene la estructura de código implementada para la eliminación ordenada de mdiobus, así que simplemente reemplace devm_mdiobus_alloc() con la variante que no es devres y agregue manual free cuando sea necesario, para garantizar que no permitamos que devres libere un bus aún registrado.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0d120dfb5d67edc5bcd1804e167dba2b30809afd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/2443ba2fe396bdde187a2fdfa6a57375643ae93c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b5652bc50dde7b84e93dfb25479b64b817e377c1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e177d2e85ebcd3008c4b2abc293f4118e04eedef\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/0d120dfb5d67edc5bcd1804e167dba2b30809afd\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/2443ba2fe396bdde187a2fdfa6a57375643ae93c\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/b5652bc50dde7b84e93dfb25479b64b817e377c1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/e177d2e85ebcd3008c4b2abc293f4118e04eedef\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
      vulnrichment: {
         containers: "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/e177d2e85ebcd3008c4b2abc293f4118e04eedef\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/b5652bc50dde7b84e93dfb25479b64b817e377c1\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/2443ba2fe396bdde187a2fdfa6a57375643ae93c\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/0d120dfb5d67edc5bcd1804e167dba2b30809afd\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T15:25:01.549Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-48812\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:58:28.399914Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:21.418Z\"}}], \"cna\": {\"title\": \"net: dsa: lantiq_gswip: don't use devres for mdiobus\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"ac3a68d56651c3dad2c12c7afce065fe15267f44\", \"lessThan\": \"e177d2e85ebcd3008c4b2abc293f4118e04eedef\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ac3a68d56651c3dad2c12c7afce065fe15267f44\", \"lessThan\": \"b5652bc50dde7b84e93dfb25479b64b817e377c1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ac3a68d56651c3dad2c12c7afce065fe15267f44\", \"lessThan\": \"2443ba2fe396bdde187a2fdfa6a57375643ae93c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ac3a68d56651c3dad2c12c7afce065fe15267f44\", \"lessThan\": \"0d120dfb5d67edc5bcd1804e167dba2b30809afd\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/dsa/lantiq_gswip.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.9\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.9\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.101\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.24\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"5.16.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.16.*\"}, {\"status\": \"unaffected\", \"version\": \"5.17\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/dsa/lantiq_gswip.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/e177d2e85ebcd3008c4b2abc293f4118e04eedef\"}, {\"url\": \"https://git.kernel.org/stable/c/b5652bc50dde7b84e93dfb25479b64b817e377c1\"}, {\"url\": \"https://git.kernel.org/stable/c/2443ba2fe396bdde187a2fdfa6a57375643ae93c\"}, {\"url\": \"https://git.kernel.org/stable/c/0d120dfb5d67edc5bcd1804e167dba2b30809afd\"}], \"x_generator\": {\"engine\": \"bippy-5f407fcff5a0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: dsa: lantiq_gswip: don't use devres for mdiobus\\n\\nAs explained in commits:\\n74b6d7d13307 (\\\"net: dsa: realtek: register the MDIO bus under devres\\\")\\n5135e96a3dd2 (\\\"net: dsa: don't allocate the slave_mii_bus using devres\\\")\\n\\nmdiobus_free() will panic when called from devm_mdiobus_free() <-\\ndevres_release_all() <- __device_release_driver(), and that mdiobus was\\nnot previously unregistered.\\n\\nThe GSWIP switch is a platform device, so the initial set of constraints\\nthat I thought would cause this (I2C or SPI buses which call ->remove on\\n->shutdown) do not apply. But there is one more which applies here.\\n\\nIf the DSA master itself is on a bus that calls ->remove from ->shutdown\\n(like dpaa2-eth, which is on the fsl-mc bus), there is a device link\\nbetween the switch and the DSA master, and device_links_unbind_consumers()\\nwill unbind the GSWIP switch driver on shutdown.\\n\\nSo the same treatment must be applied to all DSA switch drivers, which\\nis: either use devres for both the mdiobus allocation and registration,\\nor don't use devres at all.\\n\\nThe gswip driver has the code structure in place for orderly mdiobus\\nremoval, so just replace devm_mdiobus_alloc() with the non-devres\\nvariant, and add manual free where necessary, to ensure that we don't\\nlet devres free a still-registered bus.\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-12-19T08:08:12.366Z\"}}}",
         cveMetadata: "{\"cveId\": \"CVE-2022-48812\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-12-19T08:08:12.366Z\", \"dateReserved\": \"2024-07-16T11:38:08.898Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-07-16T11:44:01.907Z\", \"assignerShortName\": \"Linux\"}",
         dataType: "CVE_RECORD",
         dataVersion: "5.1",
      },
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.