CVE-2022-49826

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ata: libata-transport: fix double ata_host_put() in ata_tport_add()

In the error path in ata_tport_add(), when calling put_device(),

ata_tport_release() is called, it will put the refcount of 'ap->host'.

And then ata_host_put() is called again, the refcount is decreased

to 0, ata_host_release() is called, all ports are freed and set to

null.

When unbinding the device after failure, ata_host_stop() is called

to release the resources, it leads a null-ptr-deref(), because all

the ports all freed and null.

Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008

CPU: 7 PID: 18671 Comm: modprobe Kdump: loaded Tainted: G E 6.1.0-rc3+ #8

pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)

pc : ata_host_stop+0x3c/0x84 [libata]

lr : release_nodes+0x64/0xd0

Call trace:

ata_host_stop+0x3c/0x84 [libata]

release_nodes+0x64/0xd0

devres_release_all+0xbc/0x1b0

device_unb

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References