CVE-2022-50840

Summary

In the Linux kernel, the following vulnerability has been resolved:

scsi: snic: Fix possible UAF in snic_tgt_create()

Smatch reports a warning as follows:

drivers/scsi/snic/snic_disc.c:307 snic_tgt_create() warn: '&tgt->list' not removed from list

If device_add() fails in snic_tgt_create(), tgt will be freed, but tgt->list will not be removed from snic->disc.tgt_list, then list traversal may cause UAF.

Remove from snic->disc.tgt_list before free().

Affected Software

VendorProductVersion RangeStatus
LinuxLinuxc8806b6c9e824f47726f2a9b7fbbe7ebf19306fa < f9d8b8ba0f1a16cde0b1fc9e80466df76b6db8ffaffected
LinuxLinuxc8806b6c9e824f47726f2a9b7fbbe7ebf19306fa < 3772319e40527e6a5f2ec1d729e01f271d818f5caffected
LinuxLinuxc8806b6c9e824f47726f2a9b7fbbe7ebf19306fa < 3007f96ca20c848d0b1b052df6d2cb5ae5586e78affected
LinuxLinuxc8806b6c9e824f47726f2a9b7fbbe7ebf19306fa < 6866154c23fba40888ad6d554cccd4bf2edb755eaffected
LinuxLinuxc8806b6c9e824f47726f2a9b7fbbe7ebf19306fa < ad27f74e901fc48729733c88818e6b96c813057daffected
LinuxLinuxc8806b6c9e824f47726f2a9b7fbbe7ebf19306fa < 1895e908b3ae66a5312fd1b2cdda2da82993dca7affected
LinuxLinuxc8806b6c9e824f47726f2a9b7fbbe7ebf19306fa < c7f0f8dab1ae5def57c1a8a9cafd6fabe1dc27ccaffected
LinuxLinuxc8806b6c9e824f47726f2a9b7fbbe7ebf19306fa < 4141cd9e8b3379aea52a85d2c35f6eaf26d14e86affected
LinuxLinuxc8806b6c9e824f47726f2a9b7fbbe7ebf19306fa < e118df492320176af94deec000ae034cc92be754affected
LinuxLinux4.2affected
LinuxLinux0 < 4.2unaffected
LinuxLinux4.9.337 <= 4.9.*unaffected
LinuxLinux4.14.303 <= 4.14.*unaffected
LinuxLinux4.19.270 <= 4.19.*unaffected
LinuxLinux5.4.229 <= 5.4.*unaffected
LinuxLinux5.10.163 <= 5.10.*unaffected
LinuxLinux5.15.86 <= 5.15.*unaffected
LinuxLinux6.0.16 <= 6.0.*unaffected
LinuxLinux6.1.2 <= 6.1.*unaffected
LinuxLinux6.2 <= *unaffected

Weaknesses

References