CVE-2022-48870

published 2024-08-21

CVE-2022-48870: In the Linux kernel, the following vulnerability has been resolved: tty: fix possible null-ptr-defer in spk_ttyio_release Run the following tests on the qemu…

Priority P4 21 medium 5.5 CVSS 3.1

AV L AC L PR L UI N S U C N I N A H

In the Linux kernel, the following vulnerability has been resolved:

tty: fix possible null-ptr-defer in spk_ttyio_release

Run the following tests on the qemu platform:

syzkaller:~# modprobe speakup_audptr
input: Speakup as /devices/virtual/input/input4
initialized device: /dev/synth, node (MAJOR 10, MINOR 125)
speakup 3.1.6: initialized
synth name on entry is: (null)
synth probe

spk_ttyio_initialise_ldisc failed because tty_kopen_exclusive returned
failed (errno -16), then remove the module, we will get a null-ptr-defer
problem, as follow:

syzkaller:~# modprobe -r speakup_audptr
releasing synth audptr
BUG: kernel NULL pointer dereference, address: 0000000000000080
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
PGD 0 P4D 0
Oops: 0002 [#1] PREEMPT SMP PTI
CPU: 2 PID: 204 Comm: modprobe Not tainted 6.1.0-rc6-dirty #1
RIP: 0010:mutex_lock+0x14/0x30
Call Trace:

spk_ttyio_release+0x19/0x70 [speakup]
synth_release.part.6+0xac/0xc0 [speakup]
synth_remove+0x56/0x60 [speakup]
__x64_sys_delete_module+0x156/0x250
? fpregs_assert_state_consistent+0x1d/0x50
do_syscall_64+0x37/0x90
entry_SYSCALL_64_after_hwframe+0x63/0xcd

Modules linked in: speakup_audptr(-) speakup
Dumping ftrace buffer:

in_synth->dev was not initialized during modprobe, so we add check
for in_synth->dev to fix this bug.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 6.1.8-1 (bookworm)	linux 6.1.8-1 (bookworm)
linux	linux	—	—
linux	linux	>= 4f2a81f3a88217e7340b2cab5c0a5ebd0112514c < 2da67bff29ab49caafb0766e8b8383b735ff796f	2da67bff29ab49caafb0766e8b8383b735ff796f
linux	linux	>= 4f2a81f3a88217e7340b2cab5c0a5ebd0112514c < 64152e05a4de3ebf59f1740a0985a6d5fba0c77b	64152e05a4de3ebf59f1740a0985a6d5fba0c77b
linux	linux	>= 4f2a81f3a88217e7340b2cab5c0a5ebd0112514c < 5abbeebd8296c2301023b8dc4b5a6c0d5229b4f5	5abbeebd8296c2301023b8dc4b5a6c0d5229b4f5
linux	linux_kernel	>= 0 < 6.1.8-1	6.1.8-1
linux	linux_kernel	>= 0 < 6.1.8-1	6.1.8-1
linux	linux_kernel	>= 0 < 6.1.8-1	6.1.8-1
linux	linux_kernel	>= 5.12 < 5.15.90	5.15.90
linux	linux_kernel	>= 5.16 < 6.1.8	6.1.8

CVSS provenance

nvd v3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

osv 5.5 MEDIUM

vendor_debian 5.5 MEDIUM

vendor_redhat 5.5 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-476