CVE-2022-49605

published 2025-02-26

CVE-2022-49605: In the Linux kernel, the following vulnerability has been resolved: igc: Reinstate IGC_REMOVED logic and implement it properly The initially merged version of…

Priority P4 20 medium 5.5 CVSS 3.1

AV L AC L PR L UI N S U C N I N A H

In the Linux kernel, the following vulnerability has been resolved:

igc: Reinstate IGC_REMOVED logic and implement it properly

The initially merged version of the igc driver code (via commit
146740f9abc4, "igc: Add support for PF") contained the following
IGC_REMOVED checks in the igc_rd32/wr32() MMIO accessors:

u32 igc_rd32(struct igc_hw *hw, u32 reg)
{
u8 __iomem *hw_addr = READ_ONCE(hw->hw_addr);
u32 value = 0;

if (IGC_REMOVED(hw_addr))
return ~value;

value = readl(&hw_addr[reg]);

/* reads should not return all F's */
if (!(~value) && (!reg || !(~readl(hw_addr))))
hw->hw_addr = NULL;

return value;
}

And:

#define wr32(reg, val) \
do { \
u8 __iomem *hw_addr = READ_ONCE((hw)->hw_addr); \
if (!IGC_REMOVED(hw_addr)) \
writel((val), &hw_addr[(reg)]); \
} while (0)

E.g. igb has similar checks in its MMIO accessors, and has a similar
macro E1000_REMOVED, which is implemented as follows:

#define E1000_REMOVED(h) unlikely(!(h))

These checks serve to detect and take note of an 0xffffffff MMIO read
return from the device, which can be caused by a PCIe link flap or some
other kind of PCI bus error, and to avoid performing MMIO reads and
writes from that point onwards.

However, the IGC_REMOVED macro was not originally implemented:

#ifndef IGC_REMOVED
#define IGC_REMOVED(a) (0)
#endif /* IGC_REMOVED */

This led to the IGC_REMOVED logic to be removed entirely in a
subsequent commit (commit 3c215fb18e70, "igc: remove IGC_REMOVED
function"), with the rationale that such checks matter only for
virtualization and that igc does not support virtualization -- but a
PCIe device can become detached even without virtualization being in
use, and without proper checks, a PCIe bus error affecting an igc
adapter will lead to various NULL pointer dereferences, as the first
access after the error will set hw->hw_addr to NULL, and subsequent
accesses will blindly dereference this now-NULL pointer.

This patch reinstates the IGC_REMOVED checks in igc_rd32/wr32(), and
implements IGC

Affected

16 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 5.18.16-1 (bookworm)	linux 5.18.16-1 (bookworm)
linux	linux	—	—
linux	linux	>= 146740f9abc4976e4f0af1aa302efee1c699d2e4 < 16cb6717f4f42487ef10583eb8bc98e7d1e33d65	16cb6717f4f42487ef10583eb8bc98e7d1e33d65
linux	linux	>= 146740f9abc4976e4f0af1aa302efee1c699d2e4 < 77836dbe35382aaf8108489060c5c89530c77494	77836dbe35382aaf8108489060c5c89530c77494
linux	linux	>= 146740f9abc4976e4f0af1aa302efee1c699d2e4 < e75b73081f1ec169518773626c2ff3950476660b	e75b73081f1ec169518773626c2ff3950476660b
linux	linux	>= 146740f9abc4976e4f0af1aa302efee1c699d2e4 < 70965b6e5c03aa70cc754af1226b9f9cde0c4bf3	70965b6e5c03aa70cc754af1226b9f9cde0c4bf3
linux	linux	>= 146740f9abc4976e4f0af1aa302efee1c699d2e4 < 7c1ddcee5311f3315096217881d2dbe47cc683f9	7c1ddcee5311f3315096217881d2dbe47cc683f9
linux	linux_kernel	—	—
linux	linux_kernel	>= 0 < 5.10.136-1	5.10.136-1
linux	linux_kernel	>= 0 < 5.18.16-1	5.18.16-1
linux	linux_kernel	>= 0 < 5.18.16-1	5.18.16-1
linux	linux_kernel	>= 0 < 5.18.16-1	5.18.16-1
linux	linux_kernel	>= 4.20 < 5.4.208	5.4.208
linux	linux_kernel	>= 5.11 < 5.15.58	5.15.58
linux	linux_kernel	>= 5.16 < 5.18.15	5.18.15
linux	linux_kernel	>= 5.5 < 5.10.134	5.10.134

CVSS provenance

nvd v3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

osv 5.5 MEDIUM

vendor_debian 5.5 MEDIUM

vendor_redhat 5.5 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-476