From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0EECD216E32 for ; Wed, 26 Feb 2025 02:14:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740536076; cv=none; b=JbE8ZVaoBMo6opglfY9J2zxMCylGleL5xHd6qWqXIjOi1glbKlC62gD7Z9kKVmumN+BDI3sTaD74V+gjzmkiOk/pQMJsT3AUSf9cTdXBIwyMIO4lkKTxBYks8NCjTNr/lXe/tLKloJbdZ6qjRRDKficCMG7CJJjT1Zc+RDmn1WQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740536076; c=relaxed/simple; bh=TDsAehYmlhU4RzLK/qfhTGzl0mA+X71DVEtSGl2A9uQ=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=L7YWOzXqxRdntZJuPMf7khMaQSSVbAK2C9BQGXxjA9uJjren9qYABAPYf29pEFo9W3n29LkY1H1PlCDdrOh8oAHf/bLRDHM4bx7tSPjp/QL9ubgZlvPdMBersyKgaZNr/6gq4A47WF5eR2LYecIqGynFb5xb4ndQaWjeNqQTYSo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=hD7thv3+; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="hD7thv3+" Received: by smtp.kernel.org (Postfix) with ESMTPSA id D9CC4C4CEDD; Wed, 26 Feb 2025 02:14:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1740536075; bh=TDsAehYmlhU4RzLK/qfhTGzl0mA+X71DVEtSGl2A9uQ=; h=From:To:Cc:Subject:Date:Reply-to:From; b=hD7thv3+GU5RVHKp+enSEPmT6Gp8mLGmYlSt0qKUnPowYj5nctGxnrYlA8LXKz+Ea wPTlMqMCKJL7Ve5pLwk07OX1+HXjHmEwJjdQIPxMIrKdjLaRBJkpWxbDV7YUlogJAJ wqAXiFAWM5Q36q4GqN7Ua+5yWhRKAtv9FLU6/qL0= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2022-49459: thermal/drivers/broadcom: Fix potential NULL dereference in sr_thermal_probe Date: Wed, 26 Feb 2025 03:12:13 +0100 Message-ID: <2025022600-CVE-2022-49459-70f1@gregkh> X-Mailer: git-send-email 2.48.1 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=2805; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=TDsAehYmlhU4RzLK/qfhTGzl0mA+X71DVEtSGl2A9uQ=; b=owGbwMvMwCRo6H6F97bub03G02pJDOn7yn+opQsFitTPWBGU36cQNyvMaYFP78/D/3b+/VgzS zLAn7W2I5aFQZCJQVZMkeXLNp6j+ysOKXoZ2p6GmcPKBDKEgYtTACZif4Vhfgyr05q/kp6Litj6 khmND/6J/2uYxjA/QO+j33vGnpVGL3rPiBp0rXNI9XwKAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: thermal/drivers/broadcom: Fix potential NULL dereference in sr_thermal_probe platform_get_resource() may return NULL, add proper check to avoid potential NULL dereferencing. The Linux kernel CVE team has assigned CVE-2022-49459 to this issue. Affected and fixed versions =========================== Issue introduced in 5.1 with commit 250e211057c7237dc75634b1372a1a3bd58dcd96 and fixed in 5.4.198 with commit b3461ccaa5d2588568d865faee285512ad448049 Issue introduced in 5.1 with commit 250e211057c7237dc75634b1372a1a3bd58dcd96 and fixed in 5.10.121 with commit 79098339ac2065f4b4352ef5921628970b6f47e6 Issue introduced in 5.1 with commit 250e211057c7237dc75634b1372a1a3bd58dcd96 and fixed in 5.15.46 with commit ef1235c6514a58f274246cf4a2d5f4e40af539ce Issue introduced in 5.1 with commit 250e211057c7237dc75634b1372a1a3bd58dcd96 and fixed in 5.17.14 with commit ee9b6b02e8c140323ed46d6602d805ea735c7719 Issue introduced in 5.1 with commit 250e211057c7237dc75634b1372a1a3bd58dcd96 and fixed in 5.18.3 with commit 61621e042c22b47d1eadee617bdd26835294b425 Issue introduced in 5.1 with commit 250e211057c7237dc75634b1372a1a3bd58dcd96 and fixed in 5.19 with commit e20d136ec7d6f309989c447638365840d3424c8e Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2022-49459 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/thermal/broadcom/sr-thermal.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/b3461ccaa5d2588568d865faee285512ad448049 https://git.kernel.org/stable/c/79098339ac2065f4b4352ef5921628970b6f47e6 https://git.kernel.org/stable/c/ef1235c6514a58f274246cf4a2d5f4e40af539ce https://git.kernel.org/stable/c/ee9b6b02e8c140323ed46d6602d805ea735c7719 https://git.kernel.org/stable/c/61621e042c22b47d1eadee617bdd26835294b425 https://git.kernel.org/stable/c/e20d136ec7d6f309989c447638365840d3424c8e