{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2022-48663", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-25T13:44:28.320Z", "datePublished": "2024-04-28T13:01:36.158Z", "dateUpdated": "2024-12-19T08:05:18.465Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-12-19T08:05:18.465Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: mockup: fix NULL pointer dereference when removing debugfs\n\nWe now remove the device's debugfs entries when unbinding the driver.\nThis now causes a NULL-pointer dereference on module exit because the\nplatform devices are unregistered *after* the global debugfs directory\nhas been recursively removed. Fix it by unregistering the devices first."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpio/gpio-mockup.c"], "versions": [{"version": "3815e66c2183f3430490e450ba16779cf5214ec6", "lessThan": "bdea98b98f844bd8a983ca880893e509a8b4162f", "status": "affected", "versionType": "git"}, {"version": "3a10e8edee2b45a654f1f7b05f747129ec84cf9d", "lessThan": "18352095a0d581f6aeb1e9fc9d68cc0152cd64b4", "status": "affected", "versionType": "git"}, {"version": "bc55c1677edbe86a1c66a35e800df47dff16ad61", "lessThan": "af0bfabf06c74c260265c30ba81a34e7dec0e881", "status": "affected", "versionType": "git"}, {"version": "303e6da99429510b1e4edf833afe90ac8542e747", "lessThan": "b7df41a6f79dfb18ba2203f8c5f0e9c0b9b57f68", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpio/gpio-mockup.c"], "versions": [{"version": "5.10.144", "lessThan": "5.10.146", "status": "affected", "versionType": "semver"}, {"version": "5.15.69", "lessThan": "5.15.71", "status": "affected", "versionType": "semver"}, {"version": "5.19.10", "lessThan": "5.19.12", "status": "affected", "versionType": "semver"}]}], "references": [{"url": "https://git.kernel.org/stable/c/bdea98b98f844bd8a983ca880893e509a8b4162f"}, {"url": "https://git.kernel.org/stable/c/18352095a0d581f6aeb1e9fc9d68cc0152cd64b4"}, {"url": "https://git.kernel.org/stable/c/af0bfabf06c74c260265c30ba81a34e7dec0e881"}, {"url": "https://git.kernel.org/stable/c/b7df41a6f79dfb18ba2203f8c5f0e9c0b9b57f68"}], "title": "gpio: mockup: fix NULL pointer dereference when removing debugfs", "x_generator": {"engine": "bippy-5f407fcff5a0"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T15:17:55.854Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/bdea98b98f844bd8a983ca880893e509a8b4162f", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/18352095a0d581f6aeb1e9fc9d68cc0152cd64b4", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/af0bfabf06c74c260265c30ba81a34e7dec0e881", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b7df41a6f79dfb18ba2203f8c5f0e9c0b9b57f68", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-48663", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T15:45:58.565669Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:33:54.124Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/bdea98b98f844bd8a983ca880893e509a8b4162f", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/18352095a0d581f6aeb1e9fc9d68cc0152cd64b4", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/af0bfabf06c74c260265c30ba81a34e7dec0e881", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b7df41a6f79dfb18ba2203f8c5f0e9c0b9b57f68", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T15:17:55.854Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-48663", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T15:45:58.565669Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:19.515Z"}}], "cna": {"title": "gpio: mockup: fix NULL pointer dereference when removing debugfs", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3815e66c2183f3430490e450ba16779cf5214ec6", "lessThan": "bdea98b98f844bd8a983ca880893e509a8b4162f", "versionType": "git"}, {"status": "affected", "version": "3a10e8edee2b45a654f1f7b05f747129ec84cf9d", "lessThan": "18352095a0d581f6aeb1e9fc9d68cc0152cd64b4", "versionType": "git"}, {"status": "affected", "version": "bc55c1677edbe86a1c66a35e800df47dff16ad61", "lessThan": "af0bfabf06c74c260265c30ba81a34e7dec0e881", "versionType": "git"}, {"status": "affected", "version": "303e6da99429510b1e4edf833afe90ac8542e747", "lessThan": "b7df41a6f79dfb18ba2203f8c5f0e9c0b9b57f68", "versionType": "git"}], "programFiles": ["drivers/gpio/gpio-mockup.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.10.144", "lessThan": "5.10.146", "versionType": "semver"}, {"status": "affected", "version": "5.15.69", "lessThan": "5.15.71", "versionType": "semver"}, {"status": "affected", "version": "5.19.10", "lessThan": "5.19.12", "versionType": "semver"}], "programFiles": ["drivers/gpio/gpio-mockup.c"], "defaultStatus": "unaffected"}], "references": [{"url": "https://git.kernel.org/stable/c/bdea98b98f844bd8a983ca880893e509a8b4162f"}, {"url": "https://git.kernel.org/stable/c/18352095a0d581f6aeb1e9fc9d68cc0152cd64b4"}, {"url": "https://git.kernel.org/stable/c/af0bfabf06c74c260265c30ba81a34e7dec0e881"}, {"url": "https://git.kernel.org/stable/c/b7df41a6f79dfb18ba2203f8c5f0e9c0b9b57f68"}], "x_generator": {"engine": "bippy-5f407fcff5a0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: mockup: fix NULL pointer dereference when removing debugfs\n\nWe now remove the device's debugfs entries when unbinding the driver.\nThis now causes a NULL-pointer dereference on module exit because the\nplatform devices are unregistered *after* the global debugfs directory\nhas been recursively removed. Fix it by unregistering the devices first."}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-12-19T08:05:18.465Z"}}}, "cveMetadata": {"cveId": "CVE-2022-48663", "state": "PUBLISHED", "dateUpdated": "2024-12-19T08:05:18.465Z", "dateReserved": "2024-02-25T13:44:28.320Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-04-28T13:01:36.158Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "2EAE3A2C-3F60-40DD-AF52-8B1F528F2683", "versionEndExcluding": "5.10.146", "versionStartIncluding": "5.10.144", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E59B6451-2447-4C1E-AF94-1971FD9D8B1B", "versionEndExcluding": "5.15.71", "versionStartIncluding": "5.15.69", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D95C917A-1411-4409-A9B3-E2F4514E6A56", "versionEndExcluding": "5.19.12", "versionStartIncluding": "5.19.10", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: mockup: fix NULL pointer dereference when removing debugfs\n\nWe now remove the device's debugfs entries when unbinding the driver.\nThis now causes a NULL-pointer dereference on module exit because the\nplatform devices are unregistered *after* the global debugfs directory\nhas been recursively removed. Fix it by unregistering the devices first."}, {"lang": "es", "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: gpio: maqueta: corrige la desreferencia del puntero NULL al eliminar debugfs Ahora eliminamos las entradas debugfs del dispositivo al desvincular el controlador. Esto ahora provoca una desreferencia del puntero NULL al salir del m\u00f3dulo porque los dispositivos de la plataforma no est\u00e1n registrados *despu\u00e9s* de que el directorio global debugfs se haya eliminado de forma recursiva. Solucionarlo cancelando el registro de los dispositivos primero."}], "id": "CVE-2022-48663", "lastModified": "2025-01-14T14:53:12.910", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-04-28T13:15:07.980", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/18352095a0d581f6aeb1e9fc9d68cc0152cd64b4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/af0bfabf06c74c260265c30ba81a34e7dec0e881"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b7df41a6f79dfb18ba2203f8c5f0e9c0b9b57f68"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/bdea98b98f844bd8a983ca880893e509a8b4162f"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/18352095a0d581f6aeb1e9fc9d68cc0152cd64b4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/af0bfabf06c74c260265c30ba81a34e7dec0e881"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b7df41a6f79dfb18ba2203f8c5f0e9c0b9b57f68"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/bdea98b98f844bd8a983ca880893e509a8b4162f"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: gpio: mockup: fix NULL pointer dereference when removing debugfs", "id": "2277797", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2277797"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ngpio: mockup: fix NULL pointer dereference when removing debugfs\nWe now remove the device's debugfs entries when unbinding the driver.\nThis now causes a NULL-pointer dereference on module exit because the\nplatform devices are unregistered *after* the global debugfs directory\nhas been recursively removed. Fix it by unregistering the devices first."], "name": "CVE-2022-48663", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-04-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2022-48663\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-48663\nhttps://lore.kernel.org/linux-cve-announce/2024042801-CVE-2022-48663-397d@gregkh/T"], "statement": "Red Hat Enterprise Linux 8 is not affected by this vulnerability as the affected source code is not enabled by default.", "threat_severity": "Low", "upstream_fix": "kernel 5.10.146, kernel 5.15.71, kernel 5.19.12"}