From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 45D95213E68 for ; Wed, 26 Feb 2025 02:13:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740536017; cv=none; b=XA3SwkGXY9ZYmGs0vy3kiypD/LRF46RgC3XlpxImEPY8GH3Ldn6k9wgCsBo4iFInwB7CoQchG4mKm/TBer49yneUoTrC3Om7OYrJXW4v8KQgyAjVeAQn27t8/oOcBksr2rxBmVPi9wlbNt7iBhcQKZ9Lq67ZzA4FBN+06hYf3Do= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740536017; c=relaxed/simple; bh=HbWpGmQ3K0Gz1/5wJE99iuTeEiSEAu8EYvVd9y1qLcc=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=sZT7aylIdkWQv96EuMgr7iPtPPUTkW2Zav6n2FH+8PiAxN+sVGbG5CdT7pIeQYM/b8OcvzC4NxbCi6KULob7Ncwyh0ZFdfzUe+SK1TOmBxISraAaTHezO8q4IkPShq5h1DWS/gKORw1k3S+qOKYPsexAooY2y6wH4WOXQLLZgCw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=vbXsb551; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="vbXsb551" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 19492C4CEDD; Wed, 26 Feb 2025 02:13:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1740536017; bh=HbWpGmQ3K0Gz1/5wJE99iuTeEiSEAu8EYvVd9y1qLcc=; h=From:To:Cc:Subject:Date:Reply-to:From; b=vbXsb551CbYkTekx+wFM3hzUjccxUHTDUAZMO66tgTCO+PEk9mB6KuFdXtkmZExB3 u240AC4AaML/eT2x4KTg5UbiRNuOr+jvZ0BaIq0+UIdZpQ22Q4CdgSWLLl6Emlny1h ctDekC1duA1QxyS6MNteL0rdq10kg6BildMUaJBo= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2022-49376: scsi: sd: Fix potential NULL pointer dereference Date: Wed, 26 Feb 2025 03:10:50 +0100 Message-ID: <2025022646-CVE-2022-49376-9ec1@gregkh> X-Mailer: git-send-email 2.48.1 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=3062; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=HbWpGmQ3K0Gz1/5wJE99iuTeEiSEAu8EYvVd9y1qLcc=; b=owGbwMvMwCRo6H6F97bub03G02pJDOn7yl8tV3t+e5ru2/SNj18aHp/beaFuysqLzX/nbRDre LM5lqXetyOWhUGQiUFWTJHlyzaeo/srDil6GdqehpnDygQyhIGLUwAmcuwRwzyVF4cUXr5USvuz r6hz59FP/8wsNn5hWLBUdRLDdJtyr4eaH/7cjWK7p8xeqgMA X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: scsi: sd: Fix potential NULL pointer dereference If sd_probe() sees an early error before sdkp->device is initialized, sd_zbc_release_disk() is called. This causes a NULL pointer dereference when sd_is_zoned() is called inside that function. Avoid this by removing the call to sd_zbc_release_disk() in sd_probe() error path. This change is safe and does not result in zone information memory leakage because the zone information for a zoned disk is allocated only when sd_revalidate_disk() is called, at which point sdkp->disk_dev is fully set, resulting in sd_disk_release() being called when needed to cleanup a disk zone information using sd_zbc_release_disk(). The Linux kernel CVE team has assigned CVE-2022-49376 to this issue. Affected and fixed versions =========================== Issue introduced in 4.10 with commit 89d9475610771b5e5fe1879075f0fc9ba6e3755f and fixed in 5.10.122 with commit c1f0187025905e9981000d44a92e159468b561a8 Issue introduced in 4.10 with commit 89d9475610771b5e5fe1879075f0fc9ba6e3755f and fixed in 5.15.47 with commit 0fcb0b131cc90c8f523a293d84c58d0c7273c96f Issue introduced in 4.10 with commit 89d9475610771b5e5fe1879075f0fc9ba6e3755f and fixed in 5.17.15 with commit 78f8e96df06e2d04d82d4071c299b59d28744f47 Issue introduced in 4.10 with commit 89d9475610771b5e5fe1879075f0fc9ba6e3755f and fixed in 5.18.4 with commit 3733439593ad12f7b54ae35c273ea6f15d692de3 Issue introduced in 4.10 with commit 89d9475610771b5e5fe1879075f0fc9ba6e3755f and fixed in 5.19 with commit 05fbde3a77a4f1d62e4c4428f384288c1f1a0be5 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2022-49376 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/scsi/sd.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/c1f0187025905e9981000d44a92e159468b561a8 https://git.kernel.org/stable/c/0fcb0b131cc90c8f523a293d84c58d0c7273c96f https://git.kernel.org/stable/c/78f8e96df06e2d04d82d4071c299b59d28744f47 https://git.kernel.org/stable/c/3733439593ad12f7b54ae35c273ea6f15d692de3 https://git.kernel.org/stable/c/05fbde3a77a4f1d62e4c4428f384288c1f1a0be5