CVE-2022-49021

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: phy: fix null-ptr-deref while probe() failed

I got a null-ptr-deref report as following when doing fault injection test:

BUG: kernel NULL pointer dereference, address: 0000000000000058

Oops: 0000 [#1] PREEMPT SMP KASAN PTI

CPU: 1 PID: 253 Comm: 507-spi-dm9051 Tainted: G B N 6.1.0-rc3+

Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014

RIP: 0010:klist_put+0x2d/0xd0

Call Trace:

<TASK>

klist_remove+0xf1/0x1c0

device_release_driver_internal+0x23e/0x2d0

bus_remove_device+0x1bd/0x240

device_del+0x357/0x770

phy_device_remove+0x11/0x30

mdiobus_unregister+0xa5/0x140

release_nodes+0x6a/0xa0

devres_release_all+0xf8/0x150

device_unbind_cleanup+0x19/0xd0

//probe path:

phy_device_register()

device_add()

phy_connect

phy_attach_direct() //set device driver

probe() //it's failed, driver is not bound

device_bind_driver() // probe failed, it's not called

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References