CVE-2022-48972

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add()

Kernel fault injection test reports null-ptr-deref as follows:

BUG: kernel NULL pointer dereference, address: 0000000000000008

RIP: 0010:cfg802154_netdev_notifier_call+0x120/0x310 include/linux/list.h:114

Call Trace:

<TASK>

raw_notifier_call_chain+0x6d/0xa0 kernel/notifier.c:87

call_netdevice_notifiers_info+0x6e/0xc0 net/core/dev.c:1944

unregister_netdevice_many_notify+0x60d/0xcb0 net/core/dev.c:1982

unregister_netdevice_queue+0x154/0x1a0 net/core/dev.c:10879

register_netdevice+0x9a8/0xb90 net/core/dev.c:10083

ieee802154_if_add+0x6ed/0x7e0 net/mac802154/iface.c:659

ieee802154_register_hw+0x29c/0x330 net/mac802154/main.c:229

mcr20a_probe+0xaaa/0xcb1 drivers/net/ieee802154/mcr20a.c:1316

ieee802154_if_add() allocates wpan_dev as netdev's private data, but not

init the list in struct wpan_dev. cfg802154_netdev_notifier_call() manage

the list when dev

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References