CVE-2022-49900

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

i2c: piix4: Fix adapter not be removed in piix4_remove()

In piix4_probe(), the piix4 adapter will be registered in:

piix4_probe()

piix4_add_adapters_sb800() / piix4_add_adapter()

i2c_add_adapter()

Based on the probed device type, piix4_add_adapters_sb800() or single

piix4_add_adapter() will be called.

For the former case, piix4_adapter_count is set as the number of adapters,

while for antoher case it is not set and kept default *zero*.

When piix4 is removed, piix4_remove() removes the adapters added in

piix4_probe(), basing on the piix4_adapter_count value.

Because the count is zero for the single adapter case, the adapter won't

be removed and makes the sources allocated for adapter leaked, such as

the i2c client and device.

These sources can still be accessed by i2c or bus and cause problems.

An easily reproduced case is that if a new adapter is registered, i2c

will get the leaked adapter and try

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References