linux-cve-announce - CVE-2022-50411: ACPICA: Fix error code path in acpi_ds_call_control

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025091854-CVE-2022-50411-45ab@gregkh>
Date: Thu, 18 Sep 2025 18:04:01 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2022-50411: ACPICA: Fix error code path in acpi_ds_call_control_method()

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ACPICA: Fix error code path in acpi_ds_call_control_method()

A use-after-free in acpi_ps_parse_aml() after a failing invocaion of
acpi_ds_call_control_method() is reported by KASAN [1] and code
inspection reveals that next_walk_state pushed to the thread by
acpi_ds_create_walk_state() is freed on errors, but it is not popped
from the thread beforehand.  Thus acpi_ds_get_current_walk_state()
called by acpi_ps_parse_aml() subsequently returns it as the new
walk state which is incorrect.

To address this, make acpi_ds_call_control_method() call
acpi_ds_pop_walk_state() to pop next_walk_state from the thread before
returning an error.

The Linux kernel CVE team has assigned CVE-2022-50411 to this issue.


Affected and fixed versions
===========================

	Fixed in 4.9.337 with commit 38e251d356a01b61a86cb35213cafd7e8fe7090c
	Fixed in 4.14.303 with commit f520d181477ec29a496c0b3bbfbdb7e2606c2713
	Fixed in 4.19.270 with commit 2deb42c4f9776e59bee247c14af9c5e8c05ca9a6
	Fixed in 5.4.229 with commit 9ef353c92f9d04c88de3af1a46859c1fb76db0f8
	Fixed in 5.10.163 with commit b0b83d3f3ffa96e8395c56b83d6197e184902a34
	Fixed in 5.15.86 with commit 5777432ebaaf797e24f059979b42df3139967163
	Fixed in 6.0.16 with commit 0462fec709d51762ba486245bc344f44cc6cfa97
	Fixed in 6.1.2 with commit 799881db3e03b5e98fe6a900d9d7de8c7d61e7ee
	Fixed in 6.2 with commit 404ec60438add1afadaffaed34bb5fe4ddcadd40

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-50411
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/acpi/acpica/dsmethod.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/38e251d356a01b61a86cb35213cafd7e8fe7090c
	https://git.kernel.org/stable/c/f520d181477ec29a496c0b3bbfbdb7e2606c2713
	https://git.kernel.org/stable/c/2deb42c4f9776e59bee247c14af9c5e8c05ca9a6
	https://git.kernel.org/stable/c/9ef353c92f9d04c88de3af1a46859c1fb76db0f8
	https://git.kernel.org/stable/c/b0b83d3f3ffa96e8395c56b83d6197e184902a34
	https://git.kernel.org/stable/c/5777432ebaaf797e24f059979b42df3139967163
	https://git.kernel.org/stable/c/0462fec709d51762ba486245bc344f44cc6cfa97
	https://git.kernel.org/stable/c/799881db3e03b5e98fe6a900d9d7de8c7d61e7ee
	https://git.kernel.org/stable/c/404ec60438add1afadaffaed34bb5fe4ddcadd40