net: macb: fix NULL pointer dereference on unbind with fixed-link
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.1.189, 6.6.158, 5.11, 5.16, 6.12, and 3 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: net: macb: fix NULL pointer dereference on unbind with fixed-link When the device tree describes a fixed-link and has no "mdio" child node, macb_mii_init() returns early without allocating the MDIO bus, leaving bp->mii_bus as NULL. Two cleanup paths then dereference this NULL bus: 1. On driver unbind, macb_remove() unconditionally calls mdiobus_unregister(bp->mii_bus), which oopses: Unable to handle kernel NULL pointer dereference at virtual address 00000000000004a8 pc : mdiobus_unregister+0x14/0xa4 lr : macb_remove+0x38/0xa4 Call trace: mdiobus_unregister+0x14/0xa4 (P) macb_remove+0x38/0xa4 platform_remove+0x20/0x30 device_release_driver_internal+0x1c8/0x224 unbind_store+0xb4/0xbc 2. On the probe error path in macb_probe(), reached when macb_mii_init() has succeeded but a subsequent step fails, the err_out_unregister_mdio label runs the same unconditional cleanup. mdiobus_unregister() and mdiobus_free() do not guard against a NULL bus, so guard the calls in both macb_remove() and the probe error path.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From 831e19e565b5210930fa183730071f8290c61263 · fixed in afa224cabc0132ca414b9141b1a919ca2d318cd0; From 81db1e52848694761a1aa162ce76198af9964ed8 · fixed in 054ad8e66025eb4778d840bef80c270646cebcd2; From d0c3601f2c4e12e7689b0f46ebc17525250ea8c3 · fixed in f737d999fcb8f276d77b01ea4c2016ee01dad19b; From d0c3601f2c4e12e7689b0f46ebc17525250ea8c3 · fixed in 5710f6a74f63cbba0e15cd75917234916181c9d4; From d0c3601f2c4e12e7689b0f46ebc17525250ea8c3 · fixed in edb39c7666bb3924da761dfb417db85c1e5d8ad3; From d0c3601f2c4e12e7689b0f46ebc17525250ea8c3 · fixed in 38b6be101006d3e7af972999f45d4f1e8250587a; From 6.1.114 · fixed in 6.1.189; From 6.6.58 · fixed in 6.6.158; From 5.10.228 · fixed in 5.11; From 5.15.169 · fixed in 5.16; From 6.11.5 · fixed in 6.12
- Linux Linux
6.12
- KernelLinux
fixed in 6.1.189; From 6.2.0 · fixed in 6.6.158; From 6.7.0 · fixed in 6.12.111; From 6.12.0 · fixed in 6.18.53; From 6.13.0 · fixed in 7.2.7