linux-cve-announce - CVE-2022-49731: ata: libata-core: fix NULL pointer deref in ata_host_alloc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025022634-CVE-2022-49731-c7ba@gregkh>
Date: Wed, 26 Feb 2025 03:24:54 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2022-49731: ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo()

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo()

In an unlikely (and probably wrong?) case that the 'ppi' parameter of
ata_host_alloc_pinfo() points to an array starting with a NULL pointer,
there's going to be a kernel oops as the 'pi' local variable won't get
reassigned from the initial value of NULL. Initialize 'pi' instead to
'&ata_dummy_port_info' to fix the possible kernel oops for good...

Found by Linux Verification Center (linuxtesting.org) with the SVACE static
analysis tool.

The Linux kernel CVE team has assigned CVE-2022-49731 to this issue.


Affected and fixed versions
===========================

	Fixed in 4.9.320 with commit ca4693e6e06e4fd2b240c0fec47aa2498c94848e
	Fixed in 4.14.285 with commit 1ac5efee33f29e704226506d429b84575a5d66f8
	Fixed in 4.19.249 with commit a810bd5af06977a847d1f202b22d7defd5c62497
	Fixed in 5.4.200 with commit 253334f84c81bc6a43af489f108c0bddad989eef
	Fixed in 5.10.124 with commit 36cd19e7d4e5571d77a2ed20c5b6ef50cf57734a
	Fixed in 5.15.49 with commit ff128fbea720bf763fa345680dda5f050bc24a47
	Fixed in 5.18.6 with commit 07cbdb4807d369fbda73062a91b570c4dc5ec429
	Fixed in 5.19 with commit bf476fe22aa1851bab4728e0c49025a6a0bea307

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-49731
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/ata/libata-core.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/ca4693e6e06e4fd2b240c0fec47aa2498c94848e
	https://git.kernel.org/stable/c/1ac5efee33f29e704226506d429b84575a5d66f8
	https://git.kernel.org/stable/c/a810bd5af06977a847d1f202b22d7defd5c62497
	https://git.kernel.org/stable/c/253334f84c81bc6a43af489f108c0bddad989eef
	https://git.kernel.org/stable/c/36cd19e7d4e5571d77a2ed20c5b6ef50cf57734a
	https://git.kernel.org/stable/c/ff128fbea720bf763fa345680dda5f050bc24a47
	https://git.kernel.org/stable/c/07cbdb4807d369fbda73062a91b570c4dc5ec429
	https://git.kernel.org/stable/c/bf476fe22aa1851bab4728e0c49025a6a0bea307