| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <2025022657-CVE-2022-49084-b132@gregkh> Date: Wed, 26 Feb 2025 02:54:49 +0100 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-cve-announce@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org> Subject: CVE-2022-49084: qede: confirm skb is allocated before using Description =========== In the Linux kernel, the following vulnerability has been resolved: qede: confirm skb is allocated before using qede_build_skb() assumes build_skb() always works and goes straight to skb_reserve(). However, build_skb() can fail under memory pressure. This results in a kernel panic because the skb to reserve is NULL. Add a check in case build_skb() failed to allocate and return NULL. The NULL return is handled correctly in callers to qede_build_skb(). The Linux kernel CVE team has assigned CVE-2022-49084 to this issue. Affected and fixed versions =========================== Issue introduced in 4.18 with commit 8a8633978b842c88fbcfe00d4e5dde96048f630e and fixed in 4.19.238 with commit 9648adb1b3ece55c657d3a4f52bfee663b710dfe Issue introduced in 4.18 with commit 8a8633978b842c88fbcfe00d4e5dde96048f630e and fixed in 5.4.189 with commit 034a92c6a81048128fc7b18d278d52438a13902a Issue introduced in 4.18 with commit 8a8633978b842c88fbcfe00d4e5dde96048f630e and fixed in 5.10.111 with commit 8928239e5e2e460d95b8a0b89f61671625e7ece0 Issue introduced in 4.18 with commit 8a8633978b842c88fbcfe00d4e5dde96048f630e and fixed in 5.15.34 with commit c9bdce2359b5f4986eb38d1e81865b3586cc20d2 Issue introduced in 4.18 with commit 8a8633978b842c88fbcfe00d4e5dde96048f630e and fixed in 5.16.20 with commit b2d6b3db9d1cf80908964036dbe1c52a86b1afb1 Issue introduced in 4.18 with commit 8a8633978b842c88fbcfe00d4e5dde96048f630e and fixed in 5.17.3 with commit e1fd0c42acfa22bb34d2ab6a111484f466ab8093 Issue introduced in 4.18 with commit 8a8633978b842c88fbcfe00d4e5dde96048f630e and fixed in 5.18 with commit 4e910dbe36508654a896d5735b318c0b88172570 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2022-49084 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/net/ethernet/qlogic/qede/qede_fp.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/9648adb1b3ece55c657d3a4f52bfee663b710dfe https://git.kernel.org/stable/c/034a92c6a81048128fc7b18d278d52438a13902a https://git.kernel.org/stable/c/8928239e5e2e460d95b8a0b89f61671625e7ece0 https://git.kernel.org/stable/c/c9bdce2359b5f4986eb38d1e81865b3586cc20d2 https://git.kernel.org/stable/c/b2d6b3db9d1cf80908964036dbe1c52a86b1afb1 https://git.kernel.org/stable/c/e1fd0c42acfa22bb34d2ab6a111484f466ab8093 https://git.kernel.org/stable/c/4e910dbe36508654a896d5735b318c0b88172570
Powered by blists - more mailing lists