CVE-2022-49900

published 2025-05-01

CVE-2022-49900: In the Linux kernel, the following vulnerability has been resolved: i2c: piix4: Fix adapter not be removed in piix4_remove() In piix4_probe(), the piix4…

Priority P3 39 high 7.8 CVSS 3.1

AV L AC L PR L UI N S U C H I H A H

In the Linux kernel, the following vulnerability has been resolved:

i2c: piix4: Fix adapter not be removed in piix4_remove()

In piix4_probe(), the piix4 adapter will be registered in:

piix4_probe()
piix4_add_adapters_sb800() / piix4_add_adapter()
i2c_add_adapter()

Based on the probed device type, piix4_add_adapters_sb800() or single
piix4_add_adapter() will be called.
For the former case, piix4_adapter_count is set as the number of adapters,
while for antoher case it is not set and kept default *zero*.

When piix4 is removed, piix4_remove() removes the adapters added in
piix4_probe(), basing on the piix4_adapter_count value.
Because the count is zero for the single adapter case, the adapter won't
be removed and makes the sources allocated for adapter leaked, such as
the i2c client and device.

These sources can still be accessed by i2c or bus and cause problems.
An easily reproduced case is that if a new adapter is registered, i2c
will get the leaked adapter and try to call smbus_algorithm, which was
already freed:

Triggered by: rmmod i2c_piix4 && modprobe max31730

BUG: unable to handle page fault for address: ffffffffc053d860
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 3752 Comm: modprobe Tainted: G
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
RIP: 0010:i2c_default_probe (drivers/i2c/i2c-core-base.c:2259) i2c_core
RSP: 0018:ffff888107477710 EFLAGS: 00000246
...

i2c_detect (drivers/i2c/i2c-core-base.c:2302) i2c_core
__process_new_driver (drivers/i2c/i2c-core-base.c:1336) i2c_core
bus_for_each_dev (drivers/base/bus.c:301)
i2c_for_each_dev (drivers/i2c/i2c-core-base.c:1823) i2c_core
i2c_register_driver (drivers/i2c/i2c-core-base.c:1861) i2c_core
do_one_initcall (init/main.c:1296)
do_init_module (kernel/module/main.c:2455)
...

---[ end trace 0000000000000000 ]---

Fix this problem by correctly set piix4_adapter_count as 1 for the
single adapter so it can be normally

Affected

14 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 6.0.8-1 (bookworm)	linux 6.0.8-1 (bookworm)
linux	linux	—	—
linux	linux	>= 528d53a1592b0e27c423f7cafc1df85f77fc1163 < bfd5e62f9a7ee214661cb6f143a3b40ccc63317f	bfd5e62f9a7ee214661cb6f143a3b40ccc63317f
linux	linux	>= 528d53a1592b0e27c423f7cafc1df85f77fc1163 < d78ccdce662e88f41e87e90cf2bee63c1715d2a5	d78ccdce662e88f41e87e90cf2bee63c1715d2a5
linux	linux	>= 528d53a1592b0e27c423f7cafc1df85f77fc1163 < fe51636fffc8108c7c4da6aa393010e786530ad9	fe51636fffc8108c7c4da6aa393010e786530ad9
linux	linux	>= 528d53a1592b0e27c423f7cafc1df85f77fc1163 < 569bea74c94d37785682b11bab76f557520477cd	569bea74c94d37785682b11bab76f557520477cd
linux	linux_kernel	—	—
linux	linux_kernel	>= 0 < 5.10.158-1	5.10.158-1
linux	linux_kernel	>= 0 < 6.0.8-1	6.0.8-1
linux	linux_kernel	>= 0 < 6.0.8-1	6.0.8-1
linux	linux_kernel	>= 0 < 6.0.8-1	6.0.8-1
linux	linux_kernel	>= 5.11 < 5.15.78	5.15.78
linux	linux_kernel	>= 5.16 < 6.0.8	6.0.8
linux	linux_kernel	>= 5.4 < 5.10.154	5.10.154

CVSS provenance

nvd v3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

osv 7.8 HIGH

vendor_debian 7.8 HIGH

vendor_redhat 7.8 HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-415