linux-cve-announce - CVE-2022-49544: ipw2x00: Fix potential NULL dereference in libipw

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025022615-CVE-2022-49544-65c1@gregkh>
Date: Wed, 26 Feb 2025 03:13:38 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2022-49544: ipw2x00: Fix potential NULL dereference in libipw_xmit()

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ipw2x00: Fix potential NULL dereference in libipw_xmit()

crypt and crypt->ops could be null, so we need to checking null
before dereference

The Linux kernel CVE team has assigned CVE-2022-49544 to this issue.


Affected and fixed versions
===========================

	Fixed in 4.9.318 with commit 1ff6b0727c8988f25eeb670b6c038c1120bb58dd
	Fixed in 4.14.283 with commit b4628e0d3754ab2fc98ee6e3d21851ba45798077
	Fixed in 4.19.247 with commit 167affc11781d7d35c4c3a7630a549ac74dd0b21
	Fixed in 5.4.198 with commit 8fb1b9beb085bb767ae43e441db5ac6fcd66a04d
	Fixed in 5.10.121 with commit 98d1dc32f890642476dbb78ed3437a456bf421b0
	Fixed in 5.15.46 with commit 48d4a820fd33f012e5f63735a59d15b5a3882882
	Fixed in 5.17.14 with commit 5f7ea274e88c0eeffe6bd6dbf6cf5c479d356af6
	Fixed in 5.18.3 with commit 528d2023ccf4748fd542582955236c1634a7d293
	Fixed in 5.19 with commit e8366bbabe1d207cf7c5b11ae50e223ae6fc278b

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-49544
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/wireless/intel/ipw2x00/libipw_tx.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/1ff6b0727c8988f25eeb670b6c038c1120bb58dd
	https://git.kernel.org/stable/c/b4628e0d3754ab2fc98ee6e3d21851ba45798077
	https://git.kernel.org/stable/c/167affc11781d7d35c4c3a7630a549ac74dd0b21
	https://git.kernel.org/stable/c/8fb1b9beb085bb767ae43e441db5ac6fcd66a04d
	https://git.kernel.org/stable/c/98d1dc32f890642476dbb78ed3437a456bf421b0
	https://git.kernel.org/stable/c/48d4a820fd33f012e5f63735a59d15b5a3882882
	https://git.kernel.org/stable/c/5f7ea274e88c0eeffe6bd6dbf6cf5c479d356af6
	https://git.kernel.org/stable/c/528d2023ccf4748fd542582955236c1634a7d293
	https://git.kernel.org/stable/c/e8366bbabe1d207cf7c5b11ae50e223ae6fc278b