CVE-2022-48870

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tty: fix possible null-ptr-defer in spk_ttyio_release

Run the following tests on the qemu platform:

syzkaller:~# modprobe speakup_audptr

input: Speakup as /devices/virtual/input/input4

initialized device: /dev/synth, node (MAJOR 10, MINOR 125)

speakup 3.1.6: initialized

synth name on entry is: (null)

synth probe

spk_ttyio_initialise_ldisc failed because tty_kopen_exclusive returned

failed (errno -16), then remove the module, we will get a null-ptr-defer

problem, as follow:

syzkaller:~# modprobe -r speakup_audptr

releasing synth audptr

BUG: kernel NULL pointer dereference, address: 0000000000000080

#PF: supervisor write access in kernel mode

#PF: error_code(0x0002) - not-present page

PGD 0 P4D 0

Oops: 0002 [#1] PREEMPT SMP PTI

CPU: 2 PID: 204 Comm: modprobe Not tainted 6.1.0-rc6-dirty #1

RIP: 0010:mutex_lock+0x14/0x30

Call Trace:

<TASK>

spk_ttyio_release+0x19/0x70 [speakup]

synth_release.part.6+0

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References