CVE-2022-48914

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

xen/netfront: destroy queues before real_num_tx_queues is zeroed

xennet_destroy_queues() relies on info->netdev->real_num_tx_queues to

delete queues. Since d7dac083414eb5bb99a6d2ed53dc2c1b405224e5

("net-sysfs: update the queue counts in the unregistration path"),

unregister_netdev() indirectly sets real_num_tx_queues to 0. Those two

facts together means, that xennet_destroy_queues() called from

xennet_remove() cannot do its job, because it's called after

unregister_netdev(). This results in kfree-ing queues that are still

linked in napi, which ultimately crashes:

BUG: kernel NULL pointer dereference, address: 0000000000000000

#PF: supervisor read access in kernel mode

#PF: error_code(0x0000) - not-present page

PGD 0 P4D 0

Oops: 0000 [#1] PREEMPT SMP PTI

CPU: 1 PID: 52 Comm: xenwatch Tainted: G W 5.16.10-1.32.fc32.qubes.x86_64+ #226

RIP: 0010:free_netdev+0xa3/0x1a0

Code:

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References