CVE-2022-49826

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-49826
In the Linux kernel, the following vulnerability has been resolved: ata: libata-transport: fix double ata_host_put() in ata_tport_add() In the error path in ata_tport_add(), when calling put_device(), ata_tport_release() is called, it will put the refcount of 'ap->host'. And then ata_host_put() is called again, the refcount is decreased to 0, ata_host_release() is called, all ports are freed and set to null. When unbinding the device after failure, ata_host_stop() is called to release the resources, it leads a null-ptr-deref(), because all the ports all freed and null. Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 CPU: 7 PID: 18671 Comm: modprobe Kdump: loaded Tainted: G E 6.1.0-rc3+ #8 pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : ata_host_stop+0x3c/0x84 [libata] lr : release_nodes+0x64/0xd0 Call trace: ata_host_stop+0x3c/0x84 [libata] release_nodes+0x64/0xd0 devres_release_all+0xbc/0x1b0 device_unbind_cleanup+0x20/0x70 really_probe+0x158/0x320 __driver_probe_device+0x84/0x120 driver_probe_device+0x44/0x120 __driver_attach+0xb4/0x220 bus_for_each_dev+0x78/0xdc driver_attach+0x2c/0x40 bus_add_driver+0x184/0x240 driver_register+0x80/0x13c __pci_register_driver+0x4c/0x60 ahci_pci_driver_init+0x30/0x1000 [ahci] Fix this by removing redundant ata_host_put() in the error path.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/30e12e2be27ac6c4be2af4163c70db381364706f Patch
https://git.kernel.org/stable/c/377ff82c33c0cb74562a353361b64b33c09562cf Patch
https://git.kernel.org/stable/c/865a6da40ba092c18292ae5f6194756131293745 Patch
https://git.kernel.org/stable/c/8c76310740807ade5ecdab5888f70ecb6d35732e Patch
https://git.kernel.org/stable/c/ac471468f7c16cda2525909946ca13ddbcd14000 Patch
https://git.kernel.org/stable/c/bec9ded5404cb14e5f5470103d0973a2ff83d6a5 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*
History

10 Nov 2025, 20:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
CWE CWE-415
First Time Linux
Linux linux Kernel
CPE cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/30e12e2be27ac6c4be2af4163c70db381364706f - () https://git.kernel.org/stable/c/30e12e2be27ac6c4be2af4163c70db381364706f - Patch
References () https://git.kernel.org/stable/c/377ff82c33c0cb74562a353361b64b33c09562cf - () https://git.kernel.org/stable/c/377ff82c33c0cb74562a353361b64b33c09562cf - Patch
References () https://git.kernel.org/stable/c/865a6da40ba092c18292ae5f6194756131293745 - () https://git.kernel.org/stable/c/865a6da40ba092c18292ae5f6194756131293745 - Patch
References () https://git.kernel.org/stable/c/8c76310740807ade5ecdab5888f70ecb6d35732e - () https://git.kernel.org/stable/c/8c76310740807ade5ecdab5888f70ecb6d35732e - Patch
References () https://git.kernel.org/stable/c/ac471468f7c16cda2525909946ca13ddbcd14000 - () https://git.kernel.org/stable/c/ac471468f7c16cda2525909946ca13ddbcd14000 - Patch
References () https://git.kernel.org/stable/c/bec9ded5404cb14e5f5470103d0973a2ff83d6a5 - () https://git.kernel.org/stable/c/bec9ded5404cb14e5f5470103d0973a2ff83d6a5 - Patch

02 May 2025, 13:53

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ata: libata-transport: corrección de un error doble de ata_host_put() en ata_tport_add(). En la ruta de error de ata_tport_add(), al llamar a put_device(), se llama a ata_tport_release(), lo que resta el recuento de referencias de 'ap->host'. A continuación, se vuelve a llamar a ata_host_put(), el recuento de referencias se reduce a 0 y se llama a ata_host_release(), liberando todos los puertos y estableciéndolos en nulo. Al desvincular el dispositivo tras un fallo, se llama a ata_host_stop() para liberar los recursos, lo que genera un error null-ptr-deref(), ya que todos los puertos están liberados y en nulo. No se puede manejar la desreferencia del puntero NULL del núcleo en la dirección virtual 0000000000000008 CPU: 7 PID: 18671 Comm: modprobe Kdump: cargado Contaminado: GE 6.1.0-rc3+ #8 pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : ata_host_stop+0x3c/0x84 [libata] lr : release_nodes+0x64/0xd0 Rastreo de llamadas: ata_host_stop+0x3c/0x84 [libata] release_nodes+0x64/0xd0 devres_release_all+0xbc/0x1b0 device_unbind_cleanup+0x20/0x70 really_probe+0x158/0x320 __driver_probe_device+0x84/0x120 driver_probe_device+0x44/0x120 __driver_attach+0xb4/0x220 bus_for_each_dev+0x78/0xdc driver_attach+0x2c/0x40 bus_add_driver+0x184/0x240 driver_register+0x80/0x13c __pci_register_driver+0x4c/0x60 ahci_pci_driver_init+0x30/0x1000 [ahci] Solucione esto eliminando ata_host_put() redundante en la ruta de error.

01 May 2025, 15:16

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-01 15:16

Updated : 2025-11-10 20:15

NVD link : CVE-2022-49826

Mitre link : CVE-2022-49826

CVE.ORG link : CVE-2022-49826

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-415

Double Free