From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id ADC6A19CC02 for ; Wed, 26 Feb 2025 01:59:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740535159; cv=none; b=EjIBRAuT0pZx3WY5iq8BJOcIgR1gKgINk/g01oIaHearsyeS1usgjTmw86HVOpY4DGZAowmlJLil4gUWpkRXVUOi7NhN68ECTujxjcdWh8Jlq5gz8wl51/3VCkrwFJjtedtln7IDgbFxd2xZUJm1s8jRNdeZkg0PlkD6lrA093s= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740535159; c=relaxed/simple; bh=KtSafG+qlzzCDtRut4+PVqAcObWVBC5oM8a/9aWqihg=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=acIkWO7nba5XCFUXdTS6/KRrPoiVfJ2EMEYE2F03k6j1XcBN8RXax8y5JxVMmggszRLKAPmxMmnb/Y/AC9WXfIzHsiEwzOyv5tyydPGUjl2VdiTDUhdfEXNjB3w9O7CrPxuzlR0ybTrFNFAJjAh+ztDXGYoYkVdQHDnXue6JFgk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=jLTJnpOv; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="jLTJnpOv" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7C74EC4CEDD; Wed, 26 Feb 2025 01:59:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1740535159; bh=KtSafG+qlzzCDtRut4+PVqAcObWVBC5oM8a/9aWqihg=; h=From:To:Cc:Subject:Date:Reply-to:From; b=jLTJnpOvIs9WkY0nMSNsOPMwKbzvoXmEVJyfuvYcVffKtWVnCTyrIhjJCXE+N2Kj+ VPq4O6rlW41nAGDZENWobLatiUaqHtl4CEVnxZB2bw7V62DfaXzU8qLvyUcnu2LW2l qLaWIst7VoI4Y/ykAaFYD1v+bfmMiATcI71ECdqo= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2022-49191: mxser: fix xmit_buf leak in activate when LSR == 0xff Date: Wed, 26 Feb 2025 02:56:36 +0100 Message-ID: <2025022616-CVE-2022-49191-ed02@gregkh> X-Mailer: git-send-email 2.48.1 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=3681; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=KtSafG+qlzzCDtRut4+PVqAcObWVBC5oM8a/9aWqihg=; b=owGbwMvMwCRo6H6F97bub03G02pJDOn7SjyeR37qWCVhxJkYpbcxbo6lYeSpX5ePLpstm/249 oag7HfjjlgWBkEmBlkxRZYv23iO7q84pOhlaHsaZg4rE8gQBi5OAZjIVnGGBad0BHd4TBH+bfal c82iOQufL1/GNYthQeM54/03dnFutDvmo2BZli0pXf1mEQA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: mxser: fix xmit_buf leak in activate when LSR == 0xff When LSR is 0xff in ->activate() (rather unlike), we return an error. Provided ->shutdown() is not called when ->activate() fails, nothing actually frees the buffer in this case. Fix this by properly freeing the buffer in a designated label. We jump there also from the "!info->type" if now too. The Linux kernel CVE team has assigned CVE-2022-49191 to this issue. Affected and fixed versions =========================== Issue introduced in 2.6.33 with commit 6769140d304731f0a3b177470a2adb4bacd9036b and fixed in 4.9.311 with commit 376922045009f8ea2d20a8fa3475e95b47c41690 Issue introduced in 2.6.33 with commit 6769140d304731f0a3b177470a2adb4bacd9036b and fixed in 4.14.276 with commit 125b7c929fc9b1e5eaa344bceb6367dfa6fd3f9d Issue introduced in 2.6.33 with commit 6769140d304731f0a3b177470a2adb4bacd9036b and fixed in 4.19.238 with commit 685b6d16bf89595310b5d61394c9b97cc9505c7c Issue introduced in 2.6.33 with commit 6769140d304731f0a3b177470a2adb4bacd9036b and fixed in 5.4.189 with commit 996291d06851a26678a0fab488b6e1f0677c0576 Issue introduced in 2.6.33 with commit 6769140d304731f0a3b177470a2adb4bacd9036b and fixed in 5.10.110 with commit 2cd05c38a27bee7fb42aa4d43174d68ac55dac0f Issue introduced in 2.6.33 with commit 6769140d304731f0a3b177470a2adb4bacd9036b and fixed in 5.15.33 with commit b125b08dbee3611f03f53b71471813ed4ccafcdd Issue introduced in 2.6.33 with commit 6769140d304731f0a3b177470a2adb4bacd9036b and fixed in 5.16.19 with commit 6c9041b2f90c0eace73106f22350e1d2c98f5edc Issue introduced in 2.6.33 with commit 6769140d304731f0a3b177470a2adb4bacd9036b and fixed in 5.17.2 with commit 6dffc2035fbaada60ca8db59e0962e34f760370a Issue introduced in 2.6.33 with commit 6769140d304731f0a3b177470a2adb4bacd9036b and fixed in 5.18 with commit cd3a4907ee334b40d7aa880c7ab310b154fd5cd4 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2022-49191 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/tty/mxser.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/376922045009f8ea2d20a8fa3475e95b47c41690 https://git.kernel.org/stable/c/125b7c929fc9b1e5eaa344bceb6367dfa6fd3f9d https://git.kernel.org/stable/c/685b6d16bf89595310b5d61394c9b97cc9505c7c https://git.kernel.org/stable/c/996291d06851a26678a0fab488b6e1f0677c0576 https://git.kernel.org/stable/c/2cd05c38a27bee7fb42aa4d43174d68ac55dac0f https://git.kernel.org/stable/c/b125b08dbee3611f03f53b71471813ed4ccafcdd https://git.kernel.org/stable/c/6c9041b2f90c0eace73106f22350e1d2c98f5edc https://git.kernel.org/stable/c/6dffc2035fbaada60ca8db59e0962e34f760370a https://git.kernel.org/stable/c/cd3a4907ee334b40d7aa880c7ab310b154fd5cd4